chore(deps): remove runtime dependencies nothing imports, and unblock Dependabot's safe updates

[qmarcelle]

Replaces Dependabot PRs #4, #5 and #6, and fixes the config flaw that produced the failing #3.

The finding

Cross-checking every declared dependency of @workspacejson/rules against every import in its source:

used     @workspacejson/spec      used     remark
used     ajv                      used     remark-parse
used     fast-glob                used     simple-git
UNUSED   dedent   UNUSED   ignore   UNUSED   unified   UNUSED   zod

zod and unified appear only as string literals in the framework-detection tables (agents-md-parser.ts:75, framework-drift.ts:21) — the parser looks for the word "zod" in a manifest, it never loads the library. ignore and dedent have no references of any kind.

These were dependencies, not devDependencies, so every consumer installed all four to support code that does not exist.

@workspacejson/spec had the same problem in dev scope: json-schema-to-typescript existed for scripts/generate-types.js, which was a no-op —

const schemaPath = new URL('../schema/v1.json', import.meta.url);
await readFile(schemaPath, 'utf8');   // reads it, discards it

src/types.ts is hand-written and committed. Nothing was ever generated. Build script is now plain tsc.

Why the Dependabot PRs were misleading

#4 (ignore 5→7) and #5 (zod 3→4) both passed CI on Node 20 and 22. They passed because nothing exercises those packages. A green check on an unused dependency is not evidence of anything — which is exactly the "no false green" failure mode worth guarding against.

What prevents recurrence

A new unused-dependency guard in scripts/check-architecture.mjs, with a red test and a matching acceptance test proving it does not simply flag everything:

PASS  rejected — unused-dependency: a runtime dependency nothing imports
PASS  unused-dependency: an imported subpath dependency is ACCEPTED
25 passed, 0 failed

devDependencies are deliberately not checked — build tools, type packages and test runners are legitimately invoked by config rather than by an import statement, so absence of an import proves nothing there.

Dependabot config fix (second commit)

#3 failed on error TS5102: Option 'baseUrl' has been removed. The dev-tooling group had bundled a harmless @types/node patch with typescript ^5.4 → ^7.0 and vitest ^1.6 → ^4.1 — one safe update held hostage by two ecosystem migrations.

• The group is now restricted to minor and patch; majors arrive individually.
• typescript and vitest majors are ignored. Both are migrations rather than updates: TypeScript emits the declarations consumers install, and @workspacejson/rules re-exports vitest helpers through its published ./testing entry point, making a vitest major a public-surface change for anyone writing rule tests.

Verification

check:architecture      OK — 139 tracked files, 0 violations
check:architecture:test 25/25 (2 new)
check:docs              OK
build / typecheck       OK
tests                   36 + 173 passed, unchanged
check:schema            sha256 7f1635bb… unchanged
check:examples          4/4
release:verify-packs    OK — both tarballs release-safe

Lockfile shrinks by ~15KB.

Follow-ups, not in this PR

• tsconfig.base.json:6 sets baseUrl, which does nothing under moduleResolution: NodeNext with no paths — and is fatal under TypeScript 7. Deleting it is a one-liner that unblocks that upgrade whenever it is scheduled.
• TypeScript 7 and vitest 4 are now deliberate work rather than bot PRs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.