chore(deps): upgrade @octokit/graphql 9, TypeScript 7, Vitest 4

[joaodotwork]

Closes #29.

All three majors held back during the v1.6.0 release, done together because they share a lockfile.

@octokit/graphql 8.2.2 → 9.0.4

The one #29 flagged as high risk — every tool calls through it, and isDuplicateNameError in src/tools/iterations.ts matches on error.message text, so a restructured error would silently stop recognising duplicate-name failures and break the create_iteration_field adoption fallback.

It doesn't. v9.0.0's only breaking change is dropping Node 18 — no API change at all. Verified against the live API rather than trusting mocks:

constructor: GraphqlResponseError
instanceof Error: true
message: Request failed due to following response errors:
          - Could not resolve to a node with the global id of 'PVTIF_bogus'
has .errors array: true

Same shape the error-matching depends on, and the same format the original #21/#22 reports showed. The Node 18 drop is moot here — engines already says >=22.

typescript 5.9.3 → 7.0.2

The only upgrade that needed a code change. TypeScript 7's native compiler no longer picks up @types through pnpm's symlinked node_modules/@types, so every Node global failed to resolve:

src/auth/token-store.ts(1,20): error TS2591: Cannot find name 'crypto'.
src/index.ts(1465,3): error TS2591: Cannot find name 'process'.
… 13 errors

Fixed by declaring "types": ["node"] in tsconfig.json. That's explicit configuration rather than a workaround — it narrows ambient types to exactly what's intended, which is what the config should have said all along.

vitest 3.2.7 → 4.1.10

No changes needed. 64/64 pass on v4.

@types/node stays on ^22

Deliberately not upgraded to 26. engines declares node >=22, so the types should track the oldest supported runtime — on 26 the Node 26-only APIs would typecheck clean and then fail at runtime for anyone on 22. Revisit when the minimum moves.

Verification

• pnpm run build, pnpm run typecheck, pnpm test — 64/64 green
• dist/ emit from the new compiler smoke-tested as loadable ESM (iterations 8 exports, milestones 2)
• published tarball unchanged at 23 files / 25.5 kB

No version bump — 1.6.0 is already published and only @octokit/graphql ships to users. Worth folding into the next release rather than cutting one for it.

🤖 Generated with Claude Code