feat: upgrade shared configs for TypeScript 7

[bntvllnt]

Summary

• prepare @vllnt/typescript@2.0.0 for the stable TypeScript 7.0.2 compiler while retaining the official TypeScript 6 compatibility API for tools such as typescript-eslint
• make TypeScript 7 defaults explicit (types: [], stable ordering, side-effect import checks, no lib replacement) and document the breaking v1-to-v2 migration
• replace JSON-only smoke tests with TypeScript 6/7 compiler fixtures, declaration/runtime checks, installed-tarball validation, and real React/Vite and Next.js builds
• standardize the repository on pnpm, Vitest coverage, Prettier, ESLint, a deterministic lockfile, exact package exports, and complete public docs
• harden CI and npm OIDC publishing with SHA-pinned actions, immutable artifact verification, main-only reviewed stable releases, provenance, and retry-safe tag/package reconciliation

2.0.0 canary behavior

package.json is intentionally set to 2.0.0. After this PR merges to main, the push workflow publishes:

2.0.0-canary.<short-sha>

under the npm canary dist-tag. It does not move latest. Stable 2.0.0 remains a separate, manually reviewed environment deployment from the already-versioned main commit.

Breaking changes

• TypeScript 5 is no longer supported; the peer range is >=6.0.2 <8.
• Ambient type packages are opt-in and must be listed in each consumer's types array.
• Emitting projects must set rootDir explicitly.
• Consumers using JavaScript-API tooling should follow the documented TypeScript 6/7 side-by-side installation.

Verification

• pnpm check
  • formatting and linting pass
  • 11 compiler/package tests pass
  • 100% statements, branches, functions, and lines for test helpers
  • React 19.2.8 / Vite 8.2.2 build passes
  • Next.js 16.3.3 native TypeScript 7 build passes
• pnpm audit --audit-level high — no known vulnerabilities
• pnpm pack --dry-run --json — exact 11-file public package surface
• TypeScript 7.0.2 and TypeScript 6 compatibility compiler both validated
• independent release-gate re-review — no blockers found

Repository settings

The npm GitHub environment now requires maintainer review and restricts deployments to protected branches. No package, stable release, tag, or merge was created by this PR update.

Closes #2
Closes #3
Closes #4
Closes #5
Closes #6
Supersedes #7

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.