chore(deps-dev): bump tsx from 4.21.0 to 4.22.4 (#110)

* chore(deps-dev): bump tsx from 4.21.0 to 4.22.4

Bumps [tsx](https://github.com/privatenumber/tsx) from 4.21.0 to 4.22.4.
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.21.0...v4.22.4)

---
updated-dependencies:
- dependency-name: tsx
  dependency-version: 4.22.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* ci: skip Vercel preview deploy for Dependabot PRs (no secrets access)

Dependabot PRs run from the same repo (not a fork), so the deploy
step's fork-only guard let it through even though GitHub withholds
repository secrets from dependabot-actor runs. That caused
deploy.mjs to fail with 'missing --token'. Treat dependabot[bot]
runs the same as fork PRs: build/lint/typecheck/test still run,
but preview deploy and lighthouse are skipped until a maintainer
adds the 'trusted' label.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude <hasparus@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: 3 people

package.json

@@ -63,7 +63,7 @@
     "prettier": "^3.8.3",
     "prettier-plugin-astro": "^0.14.0",
     "prettier-plugin-tailwindcss": "^0.8.0",
-    "tsx": "^4.21.0",
+    "tsx": "^4.22.4",
     "typescript": "^5.8.3",
     "vite": "^8.1.2"
   },