chore: maintenance pass – deps, CI modernization, repo-checker fixes

[DutchmanNL]

Summary

Maintenance pass on ioBroker.sourceanalytix. This adapter was already fully modern — Node >=22, @iobroker/adapter-core ^3.4.3, ESLint flat config, jsonConfig admin UI, release-script v5, and npm Trusted Publishing (OIDC) already producing provenance attestations. The repository checker (issue #1197) reports 0 errors, 0 warnings — only the optional suggestion S4047 (add to stable repo).

So this PR is deliberately surgical: it standardizes CI/release tooling to the estate golden template and does light housekeeping, without gratuitously rewriting working config.

Changes

• .github/workflows/test-and-release.yml
  • Guard concurrency so tag/release runs are never cancelled: group ${{ github.workflow }}-${{ github.ref }}, cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }} (avoids half-finished releases / W3032).
  • adapter-tests: add timeout-minutes: 30 and strategy.fail-fast: false.
  • Sentry block and id-token: write / Trusted-Publishing deploy preserved as-is.
• .github/dependabot.yml: add open-pull-requests-limit: 15 (npm + github-actions), ignore typescript semver-minor/major bumps. Existing @types/node semver-major ignore, cooldown, and versioning-strategy: increase preserved.
• eslint.config.mjs: ignore the local .claude/ tooling directory (a stray local worktree there was the only thing failing lint locally; CI never sees it).
• .gitignore: ignore .DS_Store (two untracked .DS_Store files were present).
• README.md: add canonical ### __WORK IN PROGRESS__ changelog section with a maintenance bullet. (CHANGELOG_OLD.md was already linked.)
• Repo topics (out-of-tree): added iobroker and smart-home to the existing set.

Repo-checker codes addressed

The checker already reported no errors and no warnings. No E###/W### were outstanding to fix.

• S4047 (add to stable repo): left as a maintainer decision — not addressed here.

Not changed (already compliant)

package.json engines/deps, tsconfig.json, io-package.json (js-controller >=6.0.11 array form, admin >=7.6.20, licenseInformation, tier, titleLang, no materialize), .releaseconfig.json, and automerge-dependabot.yml were all already correct. No runtime dependency needed bumping (adapter-core, cron, iobroker-adapter-helpers all current; TypeScript 7 and @types/node 26 majors are deliberately ignored).

Bot PRs

• chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 #1204 (dependabot: typescript 5.9.3 → 7.0.2): superseded — this PR adds a dependabot ignore rule for typescript minor/major, so this major bump is intentionally not wanted. Safe to close.

Human PRs (left untouched)

• Add custom output IDs and harden source configuration and calculations #1200 (@softwarecrash — custom output IDs / calculation hardening): human feature PR, left for the maintainer.

Local verification

• npm run lint — pass
• npm run test:package — pass (58 passing)
• npm run test:integration — pass (adapter boots and stops cleanly: "The adapter starts (5400ms)", 1 passing, js-controller 7.2.3, node v24). An earlier run hung on a fixed-port EADDRINUSE 127.0.0.1:19001 collision caused by many sibling integration harnesses running in parallel on the same machine — an environment artifact, not an adapter/diff issue; the isolated re-run passed.

🤖 Generated with Claude Code