chore(deps): roll up Dependabot updates (#1059)

Co-authored-by: Amp <amp@ampcode.com>

chore(deps-dev): roll up Dependabot updates (#1043)

## Summary

- bump `@biomejs/biome` from 2.5.7 to 2.5.8 (#1042)
- bump `@types/node` from 26.1.2 to 26.2.0 (#1039)
- bump `esbuild` from 0.28.1 to 0.28.2 (#1040)
- update the Biome schema URL to 2.5.8

The TypeScript 7.0.2 update from #1029 is intentionally excluded:
`ts-jest` currently declares TypeScript `<7`, and the update causes all
unit suites to fail during ts-jest configuration.

## Validation

- `npm run all` (npm 11.10.0)

Refs: pi-session 01a08ca1-d3b3-7190-a02e-9a955e1b58b0

chore: update known checksums for 0.12.4 (#1017)

chore: update known checksums for 0.12.4

Co-authored-by: eifinger <eifinger@users.noreply.github.com>

chore(deps): roll up Dependabot updates (#1013)

## Summary

Roll up the remaining dependency changes from:

- #1008 (`@actions/glob` 0.7.0)
- #1009 (`@types/node` 26.1.2)
- #1010 (`js-yaml` 5.2.3)
- #1011 (`@biomejs/biome` 2.5.7)
- #1012 (`@types/semver` 7.8.0)

The Biome schema URL and committed action bundles are updated
accordingly.

## Validation

- `npm run all`

Refs: pi-session 019ff5b2-b439-7431-9595-b965f7fe6119

chore(deps): roll up Dependabot updates (#970)

## Summary

Roll up the remaining dependency changes from Dependabot PRs:

- #966: update `actions/setup-node` from 6.4.0 to 7.0.0
- #965: update `js-yaml` from 4.1.1 to 5.2.1
- #964: update `@types/node` from 26.0.1 to 26.1.1
- #963: update `esbuild` from 0.28.0 to 0.28.1

PRs #907 and #905 require no net changes because `@renovatebot/pep440`
5.0.0 and Jest 30.4.2 are already on `main`.

## Validation

- `npm run all`

Refs: pi-session 019f854e-4714-73ad-8de2-e79900f41b4d

chore: roll up Dependabot updates (#948)

## Summary
- roll up remaining open Dependabot updates for zizmor-action,
@actions/cache, @biomejs/biome, and @vercel/ncc
- update Biome schema and migrate recommended rules to the new preset
field
- regenerate dist bundles

## Validation
- npm run check
- npm run all

Refs: pi-session 019f4055-b39c-778f-9d9f-092115939c33

Change update-docs PR labels from 'update-docs' to 'documentation' (#945

)

Strip environment markers from detected uv dependency pins (#938)

## Summary
- strip PEP 508 environment markers before extracting uv versions from
dependency entries
- cover dependency-group pins with and without whitespace before the
marker
- cover requirements-style pins with markers

Fixes #920

## Validation
- npm ci --ignore-scripts
- npm run all

Refs: pi-session 019f316a-4108-7975-892f-ee5bf8abc7c3

chore(deps): roll up dependabot updates (#903)

Rolls up the current open Dependabot npm updates:

- #848 esbuild from 0.27.5 to 0.28.0
- #847 undici from 8.0.0 to 8.3.0
- #846 ts-jest from 29.4.9 to 29.4.11
- #841 @biomejs/biome from 2.4.10 to 2.4.15, including the matching
biome.json schema URL update

Validation:

- npm run all

fix: grant contents:write to validate-release job (#860)

## Problem

The release workflow fails at the `validate-release` job because `gh
release view` cannot find draft releases. This is because the job only
has `contents: read` permission, but GitHub requires `contents: write`
to view draft releases.

See failed run:
https://github.com/astral-sh/setup-uv/actions/runs/24528604608

## Fix

Bump `validate-release` job permissions from `contents: read` to
`contents: write`, matching the `release` job which already has this
permission.