chore(deps): refresh 8 safe minor/patch deps (#250)

## Summary

Nightly maintenance dependency refresh. Bumps the 8 minor/patch updates
that are **independent of the held-back `astro` 6→7 major**. All
version-range styles preserved (exact stays exact, caret stays caret).

| Dep | From → To | Bump | Packages |
|---|---|---|---|
| `@aws-sdk/client-bedrock-runtime` | 3.1073.0 → 3.1075.0 | minor | cli,
ingestion, summarizer, wiki |
| `@aws-sdk/client-sagemaker-runtime` | 3.1073.0 → 3.1075.0 | minor |
cli, embedder |
| `@commitlint/cli` | 21.0.2 → 21.1.0 | minor | root |
| `@commitlint/config-conventional` | 21.0.2 → 21.1.0 | minor | root |
| `@chonkiejs/core` | 0.0.10 → 0.0.11 | patch | cli, pack |
| `@biomejs/biome` | 2.5.0 → 2.5.1 | patch | root (+ `biome.json`
`$schema` synced) |
| `playwright` | 1.61.0 → 1.61.1 | patch | docs |
| `sharp` | 0.35.1 → 0.35.2 | patch | docs |

## Held back (deliberately)

- **`@astrojs/starlight` 0.40 → 0.41** — declares `peerDependencies:
astro@^7.0.2` and pulls `@astrojs/mdx@^7.0.0`, which crashes the
`@opencodehub/docs` build against `astro@6.4.8` (rollup `findVariable`
error in mdx's `dist/server.js`). starlight is coupled to the astro
major. The astro 6→7 upgrade is itself gated by the `devalue`
(GHSA-77vg-94rm-hx3p) and `esbuild` (GHSA-g7r4-m6w7-qqqr) override pins
in `pnpm-workspace.yaml`. Bump these together when astro 7 is unblocked.
- **`@types/node` 25 → 26** — major; deferred.

## Verification

Ran locally on the branch — all green:

- `pnpm -r build` (including `@opencodehub/docs` astro build)
- `tsc --noEmit` via the CI lane (`--filter '!@opencodehub/docs'`,
matching `ci.yml` and the pre-push hook)
- `biome check .` (clean, no info after `$schema` sync)
- `scripts/check-banned-strings.sh`
- `pnpm -r test` — 17 packages, **0 failures** (~1,721 tests;
platform-lane tests skipped as designed)

Pre-commit (pnpm-lock-sync, biome, banned-strings, commitlint) and
pre-push (verdict, typecheck, test) hooks passed.

🤖 Generated during OpenCodeHub nightly maintenance.

Author: theagenticguy

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
   "root": true,
   "vcs": {
     "enabled": true,

package.json

@@ -24,9 +24,9 @@
     "commit": "cz"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.0",
-    "@commitlint/cli": "21.0.2",
-    "@commitlint/config-conventional": "21.0.2",
+    "@biomejs/biome": "2.5.1",
+    "@commitlint/cli": "21.1.0",
+    "@commitlint/config-conventional": "21.1.0",
     "@types/node": "25.9.3",
     "commitizen": "4.3.2",
     "cz-conventional-changelog": "3.3.0",

packages/cli/package.json

@@ -42,9 +42,9 @@
   "//deps": "The 14 @opencodehub/* workspace libs are INLINED into the bundle at build time (tsup noExternal) — they are devDependencies, not runtime deps. `dependencies` below is exactly the third-party set the bundle imports at runtime (kept `external`), plus the two @sourcegraph/scip-* indexers the parse pipeline spawns as subprocesses. onnxruntime-web (prebuilt WASM, no native binding) is optional (lazy-loaded only when embeddings are enabled).",
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@aws-sdk/client-bedrock-runtime": "3.1073.0",
-    "@aws-sdk/client-sagemaker-runtime": "3.1073.0",
-    "@chonkiejs/core": "^0.0.10",
+    "@aws-sdk/client-bedrock-runtime": "3.1075.0",
+    "@aws-sdk/client-sagemaker-runtime": "3.1075.0",
+    "@chonkiejs/core": "^0.0.11",
     "@cyclonedx/cyclonedx-library": "10.1.0",
     "@huggingface/tokenizers": "0.1.3",
     "@iarna/toml": "2.2.5",

packages/docs/package.json

@@ -19,10 +19,10 @@
   "dependencies": {
     "@astrojs/starlight": "^0.40.0",
     "astro": "^6.4.8",
-    "sharp": "^0.35.1"
+    "sharp": "^0.35.2"
   },
   "devDependencies": {
-    "playwright": "^1.61.0",
+    "playwright": "^1.61.1",
     "rehype-mermaid": "^3.0.0",
     "starlight-links-validator": "^0.24.1",
     "starlight-llms-txt": "^0.10.0",

packages/embedder/package.json

@@ -38,7 +38,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@aws-sdk/client-sagemaker-runtime": "3.1073.0",
+    "@aws-sdk/client-sagemaker-runtime": "3.1075.0",
     "@huggingface/tokenizers": "0.1.3",
     "@opencodehub/core-types": "workspace:*"
   },

packages/ingestion/package.json

@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@aws-sdk/client-bedrock-runtime": "3.1073.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1075.0",
     "@cyclonedx/cyclonedx-library": "10.1.0",
     "@iarna/toml": "2.2.5",
     "@opencodehub/analysis": "workspace:*",

packages/pack/package.json

@@ -38,7 +38,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@chonkiejs/core": "^0.0.10",
+    "@chonkiejs/core": "^0.0.11",
     "@opencodehub/analysis": "workspace:*",
     "@opencodehub/core-types": "workspace:*",
     "@opencodehub/ingestion": "workspace:*",

packages/summarizer/package.json

@@ -39,7 +39,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@aws-sdk/client-bedrock-runtime": "3.1073.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1075.0",
     "zod": "4.4.3"
   },
   "devDependencies": {

packages/wiki/package.json

@@ -38,7 +38,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@aws-sdk/client-bedrock-runtime": "3.1073.0",
+    "@aws-sdk/client-bedrock-runtime": "3.1075.0",
     "@opencodehub/core-types": "workspace:*",
     "@opencodehub/storage": "workspace:*",
     "@opencodehub/summarizer": "workspace:*",