chore(deps-dev): bump the dev-tooling group with 3 updates

[dependabot]

Summary

Dependabot's weekly dev-tooling group bump: @types/chrome 0.2.8 → 0.2.9, @types/node 24.13.3 → 24.13.4, typescript-eslint 8.69.0 → 8.70.0. All three are development dependencies and none reaches a packaged build.

This body replaces Dependabot's generated text, which omits every Pack template section and therefore fails Review gate. The upstream changelogs remain in the PR's commit and comment history.

Root Cause / Decision Record

• Dependabot authors its own body, so a Pack template body never existed on this PR. evaluatePullRequestBody in scripts/check-pr-review-gate.mjs then reported six missing sections and the required check failed. Nothing was wrong with the dependency change itself.
• Smallest safe fix: supply the real body and record verification actually performed, rather than relax the gate for bot authors. The gate is correct to demand a disposition from whoever merges; only the author differs.
• @types/node moves patch-only here, so the engines.node major-alignment rule in .github/dependabot.yml and tests/repo/node-runtime-types-alignment.test.ts is unaffected.
• typescript-eslint 8.70.0 adds no-generated-empty-object-type. It is not enabled by this repo's config, so lint behaviour is unchanged — confirmed by a clean --max-warnings 0 run below.

Scope

• Runtime: none. No src/** change; no packaged-output change.
• Tests: no test edited. The full suite was run as a regression check against the bumped toolchain.
• Docs/governance: none.
• Explicitly out of scope: runtime React dependencies (see chore(deps): bump react and @types/react #361), permissions/CSP, Store scope, release publication.

Pack Workflow Preflight

Dependabot branches cannot use tapish-codex/<short-scope>; check-pack-workflow-preflight.mjs warns and accepts this, as it does for forks. Preflight passed in CI on this head.

• pnpm workflow:preflight was run before editing/push, or the skip reason is documented.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance or recorded the stale-guidance warning.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

Not applicable: no Sanchika adoption.

• If this PR consumes @sanchika/* packages or copied Sanchika guidance, I
  read sanchika/docs/adoption-pack.md in the coordinated parent worktree.
• If this PR consumes Sanchika, it links ComplyEaze and Axal completion evidence
  and records the Sanchika commit or copied guidance used.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent
  source paths.

Privacy And Data-Flow Impact

• No new browser permissions.
• No new host permissions.
• No new network calls.
• No analytics, telemetry, ads, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are updated if behaviour changed — behaviour did not change.

Sensitive Surface Review

• Current tab / portal target binding is preserved or intentionally changed — untouched.
• Download completion remains evidence-backed and fail-closed — untouched.
• Ambiguous side-effect delivery cannot be reported as confirmed success — untouched.
• Service-worker durability impact is understood and documented — none; no runtime code changed.
• Real taxpayer data, local paths, raw URLs/referrers, and portal HTML are absent from the diff.

Chrome Web Store Impact

• This PR does not expand beyond the existing Chrome Web Store V0 listing unless every gate in docs/PUBLICATION_READINESS.md is checked.
• Full fiscal year remains source-only and excluded from the next packaged Store build until its evidence gates are recorded.
• Store copy, README status, Privacy QA, and reviewer instructions were reviewed if user-facing behavior changed — no user-facing change.
• CI ZIP creation, provenance, and protected publishing are treated as release evidence, not manual store-submission sign-off.
• PR title uses Conventional Commits so Release Please can bump Pack after merge.

Verification

Run locally against this exact head (e3473c4) in an isolated worktree, not inferred from CI:

• pnpm install --frozen-lockfile
• pnpm exec wxt prepare
• pnpm exec prettier --check . — "All matched files use Prettier code style!"
• pnpm exec eslint . --max-warnings 0 — clean, no output
• pnpm exec tsc --noEmit — clean, no output
• pnpm exec vitest run
• pnpm exec wxt build — Σ Total size 1.12 MB
• node scripts/verify-extension-package.mjs .output/chrome-mv3 — "Pack WXT extension package verification passed."

Vitest, last three lines verbatim:

    Isolate  176 workers spawned · ~99ms startup each (spawn + environment, per file)
             at least ~17.34s faster with isolate: false — reuses workers across files instead of one per file

with the result line:

 Test Files  176 passed (176)
      Tests  3312 passed (3312)
   Duration  281.75s (tests 94%, import 5%, transform 1%)

The same suite on master at c5df536 reports an identical 176/3312 pass, so this toolchain bump introduces no test delta.

Not run, and not claimed: pnpm audit --audit-level high, wxt zip, verify-extension-zip.mjs, release-provenance and Chrome Web Store scripts. Those are release-time gates and this PR publishes nothing.

• pnpm review:gate -- --strict-head-review --wait-head-review-ms 180000 before merge/readiness claim; a missing Codex review blocks readiness:

Left unchecked deliberately. Codex review capacity is exhausted until roughly 2026-09-19, so no current-head review can arrive. CI's own invocation passes --allow-missing-head-review and recorded review-gate:allowed-missing-head-review for this head, so the required check does not depend on it. This is a dev-only dependency bump with no runtime diff, verified locally in full above.

Artifact Evidence

• CI run: see this PR's checks for head e3473c4.
• ZIP artifact: none — not a release PR.
• ZIP SHA-256: not applicable.
• Clean source/tag or head SHA: e3473c4.

PR Review Follow-Up

• GitHub Actions completed.
• Autogenerated Codex/bot review comments inspected after checks completed for the latest head SHA — none exist on this PR.
• Inline review threads are resolved, outdated, or answered with evidence — there are none.
• No commits were pushed after the last required human/bot review without re-review.
• Any follow-up PRs or issues are listed here instead of being left implicit.

Thread/comment	Disposition	Commit or evidence
None — no review threads exist on this PR	accepted	Review-thread query returns zero threads for e3473c4

Follow-up recorded rather than left implicit: #361 bumps react without react-dom and its unit tests fail with "Incompatible React versions". That is a .github/dependabot.yml grouping issue, tracked separately; it does not affect this PR.

Screenshots

None. No user-facing surface changed.

[dependabot]

Labels

The following labels could not be found: dependencies, triage. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.