Sweep deps, take ioredis 6, stop the lint hook running bunx, cut 2.7.10

[vvillait88]

Summary

Dependency sweep, a hook fix, and a version bump so this can be released.

• hono 4.12.31 to 4.12.33, jose 6.2.5 to 6.2.7, fastify 5.10.0 to 5.11.0, knip 6.29.0 to 6.31.0, @agent-score/sdk to 2.7.2 (published today). eslint 10 and TypeScript 7 stay held org-wide.
• packageManager bun@1.3.13 to 1.3.14. Version to 2.7.10.

ioredis moves to 6 as the dev dependency, and the reasoning is the point. It is an optional peer here, declared >=5.0.0, so a merchant could already bring ioredis 6 and run this code under RESP3 today while CI only ever exercised 5. Testing against the version consumers may actually supply is worth more than staying on the older one.

ioredis 6 defaults to RESP3, which changes reply shapes, so the usage was checked rather than assumed: _redis.ts constructs the client, quote_cache reads GET (string or nil in both protocols) and ignores SET's reply, and the rate-limit core branches on INCR, an integer in both. There is no SET NX predicate and no map-typed reply anywhere, so nothing here depends on the protocol version. The 1804-test suite now runs against ioredis 6, which turns that reading into a tested fact.

Deliberately no protocol: 2 pin here, unlike core/api which did pin it. Pinning the wire protocol inside a library would override a choice that belongs to the merchant supplying the peer, and this code does not need it.

The lint hook called bunx eslint, which resolves outside the project and would fetch eslint 10, the major this repo pins away from. It now runs the local binary, with a guard test asserting no hook uses bunx and that every bun run <script> hook names a script that exists. The pre-push hook already went through package scripts.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No export, signature, wire format, or 402 body shape changed.

Worth being explicit for merchants: the ioredis peer range is unchanged at >=5.0.0, so nothing is required of anyone. Merchants on ioredis 5 stay supported and untouched; the bump only changes which version this repo's own CI exercises. The only commit since v2.7.9 touched a test file.

Test plan

• bun run test: 1804 passed, 4 skipped, now running against ioredis 6
• bun run lint, bun run knip: clean
• bun run typecheck: clean across both src and examples
• bun run build: tsup CJS + ESM with subpath exports succeeded
• SDK resolution verified through the consumer (node_modules/@agent-score/sdk reports 2.7.2)

Reproduce with bun install && bun run lint && bun run typecheck && bun run knip && bun run test && bun run build.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (not applicable)
• No secrets, credentials, or personal data in the diff or the tests