chore: consolidate the open Dependabot updates into one PR #358

Roll the repository's open Dependabot pull requests into a single verified change so master picks
them up in one reviewed step instead of one merge per bump.

Open Dependabot PRs at the time of writing:

Both have been red, and neither is a lockfile problem:

• build(deps-dev): bump typescript from 5.9.3 to 6.0.3 #272 — TypeScript 6 stops inferring the common source directory once outDir is set and
  errors with TS5011, so tsconfig.json needs an explicit rootDir. Red since April.
• build(deps-dev): bump undici from 7.29.0 to 8.10.0 #347 — undici 8.0.3 made Node's built-in global fetch bypass MockAgent, so both tests in
  test/index.test.ts issue real network requests and fail on the live HTML they get back. See
  undici 8.x bypasses MockAgent for Node's global fetch (worked around in tests) #359 for the mechanism.

Both are folded into one consolidation PR.