chore: consolidate dependency automation

[christopherjnelson]

Summary

• consolidate the maintained GitHub Actions majors into one human-authored cleanup
• make routine npm and GitHub Actions version updates monthly, grouped, and limited to one open PR per ecosystem
• align Node type declarations with the Node 24 runtime
• stop tracking Next.js-managed apps/world-lab/next-env.d.ts while preserving type generation
• make the repository owner, rather than coding agents, the authority for local validation

Root causes

The foundation workflow was merged with actions/checkout@v6, actions/setup-node@v6, and pnpm/action-setup@v5 while Dependabot was scheduled weekly and GitHub Actions updates were not grouped. Dependabot therefore opened three immediate, separate action-major PRs (#2, #3, and #4). The npm ecosystem was grouped but also ran weekly, producing an additional major-update PR (#5).

The observed current CI failure was in PR #5. Dependabot changed ESLint 9.39.5 to 10.8.1 and TypeScript 5.9.3 to 7.0.2, and regenerated pnpm-lock.yaml using compact YAML serialization. The repository's Prettier-expanded lockfile format then caused pnpm format:check to fail on pnpm-lock.yaml before lint, typecheck, tests, or build ran. TypeScript 7 is also outside the installed typescript-eslint 8.67.0 peer range (>=4.8.4 <6.1.0), so those major upgrades are not incorporated into this narrow compatible cleanup.

An older foundation CI failure was unrelated: an invalid MapLibre default import prevented the Playwright web server from starting and a React ref write failed lint. That was corrected on the foundation branch before PR #1 merged; current main CI is green.

Superseded Dependabot PRs

This PR consolidates or supersedes the following routine version-update PRs, which were closed without merging:

• chore(deps): bump actions/setup-node from 6 to 7 #2: actions/setup-node v6 to v7
• chore(deps): bump pnpm/action-setup from 5 to 6 #3: pnpm/action-setup v5 to v6
• chore(deps): bump actions/checkout from 6 to 7 #4: actions/checkout v6 to v7
• chore(deps-dev): bump the workspace-dependencies group with 2 updates #5: ESLint 9.39.5 to 10.8.1 and TypeScript 5.9.3 to 7.0.2; not incorporated because the TypeScript major is incompatible with the current TypeScript ESLint peer range and the generated lockfile fails the repository format check

None of these are Dependabot security-update PRs.

Changes

• use actions/checkout@v7, actions/setup-node@v7, and pnpm/action-setup@v6 in both CI jobs
• preserve Node 24, pnpm 11.21.0, frozen installs, draft pull-request validation, pushes to main, concurrency cancellation, separate quality/build and browser-smoke jobs, and contents: read permissions
• schedule npm and GitHub Actions version updates monthly, group all updates per ecosystem, and set each ecosystem's open-pull-requests-limit to 1
• change root and game API @types/node from 26.2.0 to 24.13.3 and update only the related lockfile resolution graph
• ignore and untrack the Next.js-managed apps/world-lab/next-env.d.ts, retain it in the World Lab TypeScript include list, and run next typegen && tsc --noEmit for World Lab type checking
• document that Next.js development, build, and type generation may recreate the ignored declaration without dirtying Git
• update AGENTS.md and testing documentation so coding agents write tests/configure CI/provide commands, while the repository owner runs local validation unless explicitly delegated in-session

No dependency auto-merge workflow or configuration exists, and none is added.

Tests and checks affected

CI still runs frozen installation, formatting, lint, type checking, unit/integration tests, build, Chromium installation, and Playwright smoke tests. The World Lab typecheck now generates Next.js route types before invoking TypeScript.

No local validation suite was run by the coding agent, per repository-owner instruction. The dependency-only pnpm install --lockfile-only --ignore-scripts operation was used to resolve Node 24 types; unrelated lockfile serialization churn was removed before commit.

Automatic GitHub CI on this draft PR passed both the Quality and build and Browser smoke jobs.

Local validation checklist

Run in this order:

node --version
pnpm --version
pnpm install --frozen-lockfile
pnpm format:check
pnpm lint
pnpm typecheck
pnpm test
pnpm build
pnpm exec playwright install chromium
pnpm test:e2e

Known limitations

• ESLint 10 and TypeScript 7 remain deferred until their framework/plugin compatibility can be handled in a separately scoped dependency update.
• Local validation results are pending the repository owner.

Product impact

No product behavior, world-engine behavior, agent functionality, model-provider integration, player functionality, or World Lab design changed.