deps: bump eslint from 9.39.5 to 10.8.1 - #708

* deps: bump eslint from 9.39.5 to 10.8.1

Bumps [eslint](https://github.com/eslint/eslint) from 9.39.5 to 10.8.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.5...v10.8.1)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(lint): make eslint 10 flat config work with eslint-config-next

ESLint 10 removed context.getFilename() (used by eslint-plugin-react's
version-detect codepath) and dropped the implicit scopeManager.addGlobals
Next's bundled babel-eslint-parser relied on for plain JS. Pin an explicit
React version so detect never runs, and use plain espree for non-TS files.
Also bumps eslint-plugin-unused-imports to 4.4.1 for ESLint 10 peer support.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>

* deps: bump tailwindcss from 3.4.18 to 4.3.3

Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) from 3.4.18 to 4.3.3.
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss)

---
updated-dependencies:
- dependency-name: tailwindcss
  dependency-version: 4.3.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* deps: bump eslint from 9.39.5 to 10.8.1 (#708)

* deps: bump eslint from 9.39.5 to 10.8.1

Bumps [eslint](https://github.com/eslint/eslint) from 9.39.5 to 10.8.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.5...v10.8.1)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(lint): make eslint 10 flat config work with eslint-config-next

ESLint 10 removed context.getFilename() (used by eslint-plugin-react's
version-detect codepath) and dropped the implicit scopeManager.addGlobals
Next's bundled babel-eslint-parser relied on for plain JS. Pin an explicit
React version so detect never runs, and use plain espree for non-TS files.
Also bumps eslint-plugin-unused-imports to 4.4.1 for ESLint 10 peer support.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>

* ci: call the central auto-merge sweep — its coverage moved first (#719)

This repo was the last of the two deliberately excluded from the fleet rollout.
Its copy of auto-merge-sweep.sh shipped merges by re-arming CI so that cd.yml
(workflow_run on CI) would fire — a chain with a known hole: a CI run started by
GITHUB_TOKEN emits no workflow_run event, so CD never fires for an automated
merge. The canonical sweep closes that with a RECONCILER, enabled here via
`deploy_workflow: cd.yml`: every sweep compares main's tip against the last
successful cd.yml run and dispatches it directly when they differ. The
`post-main` hand-off in ci.yml stays as a second path; the reconciler is the
net under both.

THE TESTS MOVED BEFORE THE SCRIPT WAS DELETED. This repo was one of only two in
the fleet that ever wrote tests for the sweep, and its suite covered four things
the canonical suite did not — the in-progress defer, the stale-run wait, and
the full red-base carve-out set (green-on-failing-jobs merges; no coverage
refused; PARTIAL coverage refused). All of it is now in
dotfiles/scripts/ci/test-auto-merge-sweep.sh (17 cases, mutation-proven),
ported in bitbaum/dotfiles#34 so no assertion is lost between the two
commits.

One block of auto-merge-base-guard.test.ts was NOT about the sweep: the source
assertions on refresh-e2e-reset-tokens.mjs (fixture keyed on GITHUB_RUN_ATTEMPT,
leftover fixture cleared instead of failed on). That script stays in this repo,
so its guard stays too — moved to e2e-reset-fixture.test.ts, its own file,
because the thing it tests no longer shares context with a script this repo no
longer carries.

Verified before deleting the local copy: diffed it against the canonical and
accounted for every differing line — all of them are main_* vs base_* naming
for identical logic, the cancelled-rerun the canonical generalises, and the CI
re-arm the canonical does via REARM_WORKFLOWS. The update-branch behaviour this
repo's branch-currency tests pinned is in the canonical verbatim.

CLAUDE.md repointed: the policy section and the two-hand-offs section both named
scripts/ci/auto-merge-sweep.sh, which would have become a lie the moment this
merged.

Fleet duplication: 8 copies -> 7.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* fix(a11y): close the white-on-accent class with a gate, not a third sweep (#720)

PR #703 swept 13 files to text-on-accent, but three labels survived: the
Button 'accent' cva variant in config/design-system.ts (which is exactly
what renders the header's Get Started and the landing page's Meet your
Cat — measured live at 3.10:1), plus two inline chips. White on
--public-accent is 3.10:1 against a 4.5:1 floor; text-on-accent is 6.10:1.

Second fix of the same class, so the class is now closed: a new
check:accent-ink gate (mutation-tested — reverting the variant makes it
exit 1) runs at the head of verify. The broader design:check stays
unwired because legacy violations would turn the base red; this gate is
narrow and green today.

Co-authored-by: Georgy Butaev <41178744+g-but@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* fix(build): migrate to Tailwind v4

Keeps tailwind.config.ts as the single source of truth via v4's @config
bridge directive (same pattern already validated in solon) rather than a
full CSS-first rewrite — that migration (OKLCH, dropping the JS config
entirely) is tracked separately in this repo's own docs as future work,
not something to bundle into a dependency-version bump.

- postcss.config.js: tailwindcss + autoprefixer -> @tailwindcss/postcss
  (v4 handles vendor prefixing internally)
- globals.css: @tailwind directives -> @import "tailwindcss" + @config
- tailwind.config.ts: darkMode now needs a 2-element tuple; safelist no
  longer exists on Config (v4 moved pattern-based safelisting to
  @source inline() in CSS) — ported the dynamic initiative-color and
  gradient-opacity patterns there verbatim
- globals.css: three dead custom-class-into-@apply chains (input,
  card, viewport-fix+safe-area-padding) that v3 silently no-op'd are
  now hard errors in v4 — inlined the actual declarations they meant

Verified: full production build succeeds, lint clean, and visually
spot-checked 3 pages (home, pricing, ecosystem) in a real browser
against the built output — borders, colors, cards, badges all intact.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Georgy Butaev <41178744+g-but@users.noreply.github.com>