chore(deps): consolidate validated updates

[lamemustafa]

Summary

Consolidates the five validated Dependabot updates that are now behind master: pnpm/action-setup, React and its type pairs, @typescript-eslint/parser, globals, and Playwright.

Root Cause / Decision Record

• Dependabot PRs chore(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 #136–chore(deps-dev): bump @playwright/test from 1.61.1 to 1.62.1 #141 were created before master absorbed the current full-year and audit-remediation changes, so their failing CI results are stale.
• A clean branch from current master is safer than merging six stale lockfile variants.
• The pnpm/action-setup SHA is verified as the v6.0.10 tag commit; npm registry metadata confirms supported Node versions and unchanged licenses for the resolved package graph.
• PR chore(deps-dev): bump @types/node from 22.20.0 to 26.2.0 #139 is deliberately excluded: its Node 26 type surface exceeds Pack's Node 22 runtime contract and could mask runtime-incompatible API use.

Scope

• Runtime: React/React-DOM patch release only; no Pack application code changed.
• Tests: update the exact Playwright policy assertion to its approved version.
• Docs/governance: pin the verified pnpm/action-setup v6.0.10 commit in the three existing workflows.
• Explicitly out of scope: Node 26 type definitions, new dependencies, permissions, portal behavior, and release/store publication.

Pack Workflow Preflight

• pnpm workflow:preflight passed before push.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

• This PR does not consume @sanchika/* packages or copied Sanchika guidance.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent source paths.

Privacy And Data-Flow Impact

• No new browser permissions.
• No new host permissions.
• No new network calls.
• No analytics, telemetry, ads, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are unchanged because behavior did not change.

Sensitive Surface Review

• Current tab / portal target binding is unchanged.
• Download completion remains evidence-backed and fail-closed.
• Ambiguous side-effect delivery cannot be reported as confirmed success.
• Service-worker durability is unchanged.
• Real taxpayer data, local paths, raw URLs/referrers, and portal HTML are absent from the diff.

Chrome Web Store Impact

• This PR does not expand beyond the existing Chrome Web Store V0 listing.
• Full fiscal year remains source-build alpha and is not part of the Chrome Web Store V0 listing.
• Store copy, README status, Privacy QA, and reviewer instructions are unchanged because user-facing behavior did not change.
• CI ZIP creation, provenance, and protected publishing remain release evidence, not manual store-submission sign-off.
• PR title uses Conventional Commits.

Verification

• pnpm install --frozen-lockfile
• pnpm audit --audit-level high — no known vulnerabilities found.
• pnpm exec wxt prepare
• pnpm exec prettier --check .
• pnpm exec eslint . --max-warnings 0
• pnpm exec tsc --noEmit
• pnpm exec vitest run — 103 files, 1,653 tests passed.
• pnpm exec wxt build
• node scripts/verify-extension-package.mjs .output/chrome-mv3
• pnpm exec wxt zip — release-only, not run.
• node scripts/verify-extension-zip.mjs — release-only, not run.
• node scripts/write-release-provenance.mjs — release-only, not run.
• node scripts/verify-github-release-assets.mjs --tag <tag> --zip <zip> --checksum <sha256> --provenance <json> — release assets do not exist.
• node scripts/publish-chrome-web-store.mjs --zip .output/<zip> --provenance .output/pack-release-provenance.v1.json --publisher-id <id> --dry-run true — release-only, not run.
• git diff --check
• pnpm review:gate -- --strict-head-review --required-review-author chatgpt-codex-connector --wait-head-review-ms 180000 --allow-missing-head-review — after PR review completes.

Artifact Evidence

• CI run: pending.
• ZIP artifact: not applicable to this source-build dependency PR.
• ZIP SHA-256: not applicable.
• Clean source/tag or head SHA: 7cb8a27.

PR Review Follow-Up

• GitHub Actions completed.
• Autogenerated Codex/bot review comments inspected after checks completed for the latest head SHA.
• Inline review threads: not applicable at opening.
• No commits were pushed after the current head.
• Follow-up: Dependabot PR chore(deps-dev): bump @types/node from 22.20.0 to 26.2.0 #139 will be closed with the Node 22/Node 26 type-surface rationale.

Thread/comment	Disposition	Commit or evidence
Dependabot #136, #137, #138, #140, #141	superseded	Consolidated as 7cb8a27 after current-master validation
Dependabot #139	rejected	Node 26 type surface is outside Pack's Node 22 runtime contract

Screenshots

Not applicable; no user-facing visual change. All test data is synthetic.

DCO

• Commit 7cb8a27 includes a Signed-off-by trailer.