chore(deps): batch four Dependabot updates and fix the workspace-member config defect

[xiaolai]

Batches the four mergeable Dependabot PRs into one CI cycle, and fixes the config defect that made two others unmergeable by construction.

Dependency bumps

Each branch is merged with --no-ff, so every Dependabot commit is preserved and each PR closes as merged with its own merge commit in the history. All four were independently green before batching; CI here verifies the combined tree, which is the property strict: true actually requires.

PR	Scope	Contents
#1261	npm, root workspace	34 minor/patch updates (root + server/mcp + server/content + root lockfile)
#1260	cargo	thiserror 2.0.18→2.0.20, base64 0.23.0→0.23.1, rusqlite 0.38.1→0.38.2 (lockfile only — all transitive)
#1241	github-actions	SHA-pinned bumps of pnpm/action-setup, dorny/paths-filter, taiki-e/install-action, anthropics/claude-code-action — all within their existing major, comment tags updated
#1238	npm, website	mermaid 11.15.0→11.16.1, vue 3.5.40→3.5.41

No file overlap between the four, so no conflicts. No @tauri-apps/* package or tauri-* crate moves, so lint:tauri-versions has no skew to find.

Batching rather than merging serially is worth stating: with strict: true each serial merge puts the rest behind and costs another full cycle, so four merges is ~228 runner-minutes to verify four orthogonal, already-green bumps. This is one cycle, on the exact tree that lands.

Config fix: unmergeable workspace-member PRs

server/mcp and server/content are pnpm workspace members. They have no lockfile of their own — the root pnpm-lock.yaml is the only one that resolves them. A per-directory Dependabot entry can only rewrite that member's package.json, never the root lockfile, so every PR those two entries opened was born failing:

ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because
pnpm-lock.yaml is not up to date with <ROOT>/server/mcp/package.json

That is not a flake to retry — it is the entry doing exactly what it is configured to do. Six such PRs were opened and five closed unmerged: #1259, #1239, #1237, #1189, #1167, #1166.

Both entries are deleted. The root / entry already covers the whole workspace — #1261 in this batch updates package.json, pnpm-lock.yaml, server/content/package.json and server/mcp/package.json together, and its bumps are byte-identical to #1259's and a superset of #1239's (hono ^4.13.1 vs ^4.13.0, plus a katex bump #1239 never had). Coverage is preserved, including the @types/node major-version ignore, which now applies workspace-wide. Closing #1259 and #1239 as superseded.

Recorded, not fixed: the website lockfile gap

website/ is deliberately outside the pnpm workspace and keeps its own website/pnpm-lock.yaml, but Dependabot updates only website/package.json — #1238 changes no lockfile, and neither did #1129 or #1038. So each website bump lands a manifest its lockfile does not match.

It is silent rather than red because deploy-website.yml installs website deps without --frozen-lockfile, so the build resolves fresh and passes while the committed lockfile stops meaning anything. It has already needed two manual repair commits: bfc7d2456 fix(website): sync the website lockfile with its package.json and c5486c5e3 fix(website): sync pnpm-lock with package.json to unblock deploy.

This PR resyncs the lockfile so it does not become a third — verified by installing with --frozen-lockfile (which now passes) and running a full vitepress build. The underlying gap is written into dependabot.yml with the remedy, but deliberately left open, because closing it is a real choice between two different designs: move website/ into the pnpm workspace so the root entry owns it, or keep it separate and add a gate that makes the drift fail loudly. That decision is the maintainer's, not a drive-by in a dependency PR.

Verification

• Each constituent PR: green on frontend and rust before batching.
• website: pnpm install --ignore-workspace --frozen-lockfile passes, pnpm build completes.
• .github/dependabot.yml: parses; entries reduce to npm /, npm /website, cargo /src-tauri, github-actions /.
• This PR's own CI is the gate on the combined tree.