chore: TypeScript 7.0.2; Bun 1.4.0 pins; dependabot bun

[andrescera]

What

• TypeScript ^5→^7.0.2 with TS6/7 config migration (baseUrl removed, paths converted to tsconfig-relative form)
• Bun 1.4.0 pins and Dependabot npm→Bun configuration
• Biome canon 2.5.9 and @ceralive/biome-config 2026.8.1, kept as an exact pin matching this repo’s convention
• Node-26 consumer fixtures deliberately retained as a documented island to prove published-package Node compatibility

Why

Workspace-wide Bun 1.4.0 + TypeScript 7 migration, as the sibling PR to merged root policy PR #81.

How to verify

bun install && bun run lint && bun run typecheck && bun test && bun run build
cd control && bun run verify:tarball && bun run verify:consumers

Risks

Low — packaging is untouched, the published API surface tarball-shape gate remains non-vacuous, and strict TypeScript settings are not weakened.