* fix(deps): handle dagHeads now being optional in mero-js 7.3.2

* fix(release): escalate breaking changes to a major version

Custom releaseRules are matched on their own, and the default rules are
consulted only when no custom rule matches at all. Every commit type here
had a custom rule, so the default `{ breaking: true, release: "major" }`
was unreachable and a `fix:` carrying a BREAKING CHANGE footer released as
a patch.

* chore(deps): bump the semantic-release toolchain

@semantic-release/npm vendors the npm CLI, and the 12.x line pins npm
10.9.8 - the source of all 12 high and the 1 critical audit finding. 13.x
vendors npm 11. semantic-release 25 needs node >=22.14, so the release
workflow moves to node 24, which also brings the npm >=11.5.1 that OIDC
trusted publishing requires.

conventional-changelog-conventionalcommits goes to 10.x because
commit-analyzer 13 reads parser options off `loadedConfig.parser`, a shape
7.x does not export. On 7.x the preset silently fell back to the default
parser, which cannot see the `!` breaking marker, so `fix!:` commits
produced no release at all.

npmPublish stays false and the separate npm publish step is unchanged; the
only breaking change in semantic-release 25 is the node floor.

* ci: audit what ships, not the release tooling