📦 Dependency Major Bumps

Each major validated independently in an isolated worktree off main. Click a row for the evidence. Breakers dropped, not papered over.
▶esbuild^0.27 → ^0.28.0KEPT
hooks bundle byte-stable (791.66 KB split / 360.49 KB unified), .sql runtime assets copied to dist/, tsc --noEmit exit 0. mcp-server byte-identical. docs/site next build ✓.
▶@types/node^22 → ^24.12.4KEPT
typecheck + build clean across hooks, mcp-server, hook-contract, docs/site. 269 pages generated. Normalized to ^24 across all 4 packages.
▶lucide-react^0.475 → ^1.17.0KEPT
docs/site next build ✓. All named icon exports (Check, Copy, ArrowRight, Search, X, ChevronRight, ExternalLink, SearchX…) resolved across 7 site files + fumadocs-ui. 269 static pages prerendered.
▶typescript^5.x → ^6.0.3DROPPED
TS 6.0.3 broke hook-contract build:esm with 7× TS2591 (Cannot find 'node:crypto' / 'Buffer'). Root cause: TS 6.0 changed default @types auto-inclusion when lib is set and no "types" field exists. Fixing would require loosening tsconfig — disallowed. A/B-proven: TS 5.9.3 clean, 6.0.3 fails. Reverted across all 4 package.json, zero leakage.