Major dependency upgrades: @octokit/graphql 9, TypeScript 7, Vitest 4 #29

Four majors are behind as of v1.6.0. They were held back deliberately during the release rather than bumped blind — each needs its own verification.

Why @octokit/graphql 9 is the one that matters

It's the client every tool in this server calls through, and the injected GraphQLFn type flows into all of src/tools/*. A major there can change:

• Error shapes. isDuplicateNameError in src/tools/iterations.ts matches on error.message text (/name has already been taken/i). If v9 restructures errors, the create_iteration_field adoption fallback silently stops recognising duplicates and starts rethrowing — the exact path create_iteration_field and add_iteration fail with GraphQL input-type errors #21/add_iteration & create_iteration_field send outdated payload (GitHub schema mismatch) #22 were about.
• The GraphQLFn type surface, which is the seam every unit test mocks. Mocks that no longer match the real signature would still pass while the real client diverges — this repo has been bitten by exactly that before (the pre-fix(iterations): correct GraphQL schema misuse and preserve item assignments #26 tests mocked a fabricated schema and passed against broken code).

So this one wants the error-handling paths exercised against the live API, not just a green unit suite.

@types/node should stay on ^22

Not part of this upgrade, and deliberately so: engines declares node >=22, so the types should match the oldest supported runtime. Bumping to 26 would let Node 26-only APIs typecheck clean and then fail at runtime for users on 22.

Worth revisiting only if the minimum supported Node moves.

Done when

• All three majors upgraded, lockfile committed
• pnpm run build, pnpm run typecheck, pnpm test green on Node 22 and 24
• isDuplicateNameError and the iteration error paths verified against the live GraphQL API, not just mocks
• Changelogs read for breaking changes, anything relevant noted in the PR

Follows the v1.6.0 release (#27).