chore(deps): clear 195 of 236 dependency advisories (0 critical left) - #427

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Releases created by release-please use the default GITHUB_TOKEN, and
GitHub does not fire `on: release` workflows for events created with
that token — so publish-package.yml never auto-ran and every npm
publish had to be dispatched manually.

workflow_dispatch is an explicit exception to that rule, so the
release job now dispatches the existing publish-package.yml (the
single publishing path) once per released tag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

# Conflicts:
#	.release-please-manifest.json
#	packages/api/CHANGELOG.md
#	packages/api/package.json
#	packages/bucketing/CHANGELOG.md
#	packages/bucketing/package.json
#	packages/cloudflare/CHANGELOG.md
#	packages/cloudflare/package.json
#	packages/data/CHANGELOG.md
#	packages/data/package.json
#	packages/enums/CHANGELOG.md
#	packages/enums/package.json
#	packages/event/CHANGELOG.md
#	packages/event/package.json
#	packages/experience/CHANGELOG.md
#	packages/experience/package.json
#	packages/js-sdk/CHANGELOG.md
#	packages/js-sdk/package.json
#	packages/logger/CHANGELOG.md
#	packages/logger/package.json
#	packages/rules/CHANGELOG.md
#	packages/rules/package.json
#	packages/segments/CHANGELOG.md
#	packages/segments/package.json
#	packages/types/CHANGELOG.md
#	packages/types/package.json
#	packages/utils/CHANGELOG.md
#	packages/utils/package.json

…vert

chore: merge main into main-convert

Takes the repo from 236 open advisories (3 critical / 105 high) to 41
(0 critical / 11 high), measured with `yarn npm audit --all --recursive`.

No published package is affected either way: every packages/* manifest
declares an empty `dependencies` apart from js-sdk-utils -> murmurhash,
so the alerts all trace to the demo apps and dev tooling.

- lockfile re-resolution (`yarn up -R`) clears 151 advisories on its own,
  with no manifest edits
- next 16.0.1 -> 16.3.0 clears the last critical (React flight RCE)
- wrangler 3 -> 4, @nestjs/* -> 11.1.28, @remix-run/* -> 2.17.5,
  react-router-dom -> 7.18.2, nyc -> 18
- chai 4 -> 6 across every test package

chai >=5 exports a sealed ES module namespace, so `chai.use(spies)` can
no longer attach `.spy` in place. The event tests now capture what
`use()` returns instead. All 546 mocha tests pass.

The 41 remaining advisories sit behind parents that are already at their
latest published version: react-scripts@5.0.1 (14), @remix-run v2 (9),
the jsdoc/better-docs chain (8), wrangler -> miniflare -> undici (5),
mocha/nyc/browserify internals (5).

Known issue, not yet resolved: `yarn build` fails on packages/enums in
this state - rollup-plugin-typescript2 stops resolving relative imports
after the recursive lockfile refresh. Ruled out rollup, plugin-commonjs,
plugin-terser, glob, rollup-plugin-dts, dotenv, tslib, typescript, a
stale rpt2 cache and the @types auto-inclusion; the culprit is not yet
pinpointed. The test suite stays green through it, so tests alone do not
catch this.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The recursive lockfile refresh in the previous commit broke `yarn build`:
rollup-plugin-typescript2 silently stopped transforming and resolving,
so rollup fell back to parsing raw TypeScript as JavaScript. Symptoms
differed per package - `Could not resolve "./src/..."` in enums, and
`Expected ',', got ':'` in js-sdk - but both are the same plugin going
inert.

Bisected on a pristine clone with a single variable: `yarn up -R
picomatch` on its own takes the build from passing to failing.
picomatch 2.3.1 -> 2.3.2 is itself a required security bump (4 advisories),
so pinning it back is not an option.

rollup-plugin-typescript2 0.37.0 works with picomatch 2.3.2, so the fix
is to move the plugin forward rather than hold the transitive back.

Verified after the change:
- `yarn build` at the repo root: 50 bundles, exit 0
- `yarn lint` in packages/js-sdk: clean
- all 546 mocha tests across the 10 test packages: passing
- advisories unchanged at 41 (0 critical, 11 high), down from 236

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

`pass-qa` still failed on `yarn install --immutable` (YN0028) after the
previous fix, because I had misdiagnosed the cause.

`generate-rollup-config.mjs` rewrites each package's **source**
`package.json` on every build, pinning `peerDependencies` to the current
sibling workspace versions:

    peerDependencies: {...info.peerDependencies, ...peerDependencies}
    writeFileSync(resolve(`${basePath}/package.json`), ...)

So `yarn build` - not `yarn up` - is what turned ranges like
`@convertcom/js-sdk-types: ">=3.11.0"` into `">=4.0.0"`. Running the
verification build and then `git add -A` swept that mutation into the
commit, while the lockfile still carried the ranges from before it. CI
installs before it builds, so a clean checkout disagrees with the
committed manifests every time.

All 47 peer ranges are back to their `main-convert` values and the
lockfile matches them. Only `devDependencies` differ from `main-convert`
now, which is all the advisory work needed - no published package
changes.

Note for whoever picks this up: the build mutating tracked source files
means any `yarn build` leaves a dirty tree. Worth separating the
generated `lib/package.json` from the source manifest, but that is out of
scope here.

Verified at this commit, with no build run afterwards:
- `yarn install --immutable` - passes (the failing CI step)
- peerDependencies byte-identical to origin/main-convert in all 11 packages

Build and test results from the same dependency state, before the
restore: 50 bundles, 546 mocha tests, 47 browser tests, lint clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>