chore: modernize package tooling and CI

[tonyketcham]

Summary of changes

This branch contains five reviewable stack entries shaped by proof plus an adversarial proof follow-up:

1. chore: modernize package test toolchain

   • Updates the existing Vitest-backed packages (@flatbread/codegen, @flatbread/utils) to current Vitest/Vite/TypeScript/tsup/Node typings.
   • Adds package-local TS configs so TS 6 options stay scoped to those packages.
   • Adds root typecheck, split test:ava/test:vitest, full test, and verify scripts.
   • Pins packageManager and the Node floor for the modern Vite/Vitest toolchain.

2. ci: harden pipeline verification

   • Pins pnpm to 10.33.0, uses pnpm install --frozen-lockfile, and approves required native build dependencies for pnpm 10.
   • Adds read-only workflow permissions and cancellation concurrency.
   • Runs proof typecheck in CI and routes tests through the root command that now includes AVA plus Vitest.
   • Fixes the SvelteKit integration job so it builds the SvelteKit example instead of duplicating the Next.js build.

3. docs: record tooling modernization decisions

   • Documents the Biome/Oxc evaluation and why neither is adopted in this low-risk pass.
   • Captures migration notes, rollback considerations, measured local runtime notes, and deferred follow-ups.

4. chore: clean modernization config smells

   • Removes package-local pnpm.peerDependencyRules blocks that pnpm ignores; the root remains the single policy owner.
   • Adds missing workspace path aliases for @flatbread/codegen and @flatbread/resolver-svimg.
   • Makes the Next.js example declare its flatbread workspace CLI dependency explicitly.
   • Corrects SvelteKit example repository metadata.

5. docs: align modernization developer guidance

   • Updates contributor prerequisites to Node 20.19+ and pnpm 10.33.x/Corepack.
   • Documents pnpm verify, the real AVA/Vitest split, and Prettier as the enforced lint gate.
   • Fixes stale example links and a broken fieldNameTransform README snippet.

Adversarial audit notes:

• A second proof DAG completed 5/5 tasks and drove the config/docs remediations above.
• Deferred findings include full AVA→Vitest migration, root ESLint repair/removal, project references, svelte-check after route data typing is fixed, deprecated runtime dependency cleanup, and optional GitHub Action SHA pinning.

Migration notes:

• Root typecheck is intentionally scoped to @flatbread/proof until more packages expose typecheck scripts or project references.
• svelte-check remains deferred because the existing SvelteKit route data types report a pre-existing data.allPostCategories error after svelte-kit sync; CI now validates the SvelteKit production build.
• Biome/Oxc are deferred until root ESLint ownership is repaired or explicitly removed, and until formatting boundaries for Markdown/YAML/framework examples are explicit.

Rollback considerations:

• Revert the first commit to restore prior package scripts and codegen/utils package-local toolchain versions.
• Revert the second commit to restore the prior workflow and pnpm build-script policy.
• Revert the third commit to remove the initial decision record only.
• Revert the fourth commit to restore prior package metadata, pnpm warning behavior, and path aliases.
• Revert the fifth commit to restore prior documentation only.

Before/after runtime impact:

• Initial proof DAG audit completed 5/5 tasks in ~1m09s.
• Adversarial proof DAG audit completed 5/5 tasks in ~55s.
• Full local verification chain (pnpm install --frozen-lockfile && pnpm lint && pnpm typecheck && pnpm build && pnpm test) completed in ~40s after the adversarial fixes.
• Sequential local example builds completed in ~22s after the adversarial fixes.
• Exact GitHub Actions runtime impact should be measured from PR checks; expected improvements are deterministic installs, cancellation of superseded runs, and replacing duplicate Next.js integration work with real SvelteKit build coverage.

Follow-ups deferred:

• Repair or remove dormant root ESLint in a dedicated PR; reconsider Biome/Oxc only after that boundary is explicit.
• Add package-level typecheck scripts/project references across the monorepo.
• Unify AVA/Vitest or document longer-term ownership.
• Add coverage thresholds after test runner boundaries are settled.
• Resolve SvelteKit route data typing and then add svelte-check to CI.
• Audit Apollo Server v3, Express-GraphQL, @nrwl/workspace, tsconfig-paths, and other deprecated/possibly dead dependencies separately.

Closes #

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• I added doc comments to any new public exports, and inline comments to any hard-to-understand areas
• My changes generate no new console errors locally
• If applicable, try to include a test that fails without this PR but passes with it

Does this introduce any non-backwards compatible changes?

• Yes
• No

Does this include any user config changes?

• Yes
  • If so, I have updated the relevant areas of documentation
• No