chore(deps): bump @shikijs/twoslash from 3.22.0 to 4.3.0 (#114)

* chore(deps): bump @shikijs/twoslash from 3.22.0 to 4.3.0

Bumps [@shikijs/twoslash](https://github.com/shikijs/shiki/tree/HEAD/packages/twoslash) from 3.22.0 to 4.3.0.
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.3.0/packages/twoslash)

---
updated-dependencies:
- dependency-name: "@shikijs/twoslash"
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* ci: skip Vercel preview deploy for Dependabot PRs (no secrets access)

Dependabot PRs run from the same repo (not a fork), so the deploy
step's fork-only guard let it through even though GitHub withholds
repository secrets from dependabot-actor runs. That caused
deploy.mjs to fail with 'missing --token'. Treat dependabot[bot]
runs the same as fork PRs: build/lint/typecheck/test still run,
but preview deploy and lighthouse are skipped until a maintainer
adds the 'trusted' label.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude <hasparus@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: 3 people

package.json

@@ -29,7 +29,7 @@
     "@fontsource-variable/brygada-1918": "^5.2.8",
     "@fontsource-variable/inter": "^5.2.8",
     "@mdx-js/mdx": "3.1.1",
-    "@shikijs/twoslash": "^3.22.0",
+    "@shikijs/twoslash": "^4.3.0",
     "@tailwindcss/postcss": "4.3.1",
     "@types/react": "^19.2.17",
     "@types/unist": "^3.0.3",