build(deps): integrate validated Dependabot updates

[trvon]

Summary

Integrate the five reviewed Dependabot updates onto current master in one compatibility-tested batch:

• build(deps-dev): bump typebox from 1.3.16 to 1.3.20 #81: TypeBox 1.3.16 → 1.3.20
• build(deps-dev): bump @earendil-works/pi-tui from 0.84.2 to 0.84.4 #82 and build(deps-dev): bump @earendil-works/pi-coding-agent from 0.84.2 to 0.84.4 #83: Pi TUI and Pi coding agent 0.84.2 → 0.84.4, pinned together
• build(deps-dev): bump @biomejs/biome from 2.5.9 to 2.5.11 #84: Biome 2.5.9 → 2.5.11
• build(deps-dev): bump @types/node from 26.2.0 to 26.4.0 #85: Node types 26.2.0 → 26.4.0

Only package.json and package-lock.json change. Original Dependabot commit ancestry is preserved; adjacent Pi dependency-declaration conflicts were resolved by selecting 0.84.4 for both packages. No source changes, threshold reductions, release metadata changes, or unrelated upgrades.

Merge with a merge commit, not squash/rebase: this lands the SDK/TUI pair atomically and includes all five original PR heads on master.

Validation

Clean isolated npm ci with actual locked dependencies (not shared node_modules), verified Pi CLI/SDK/TUI 0.84.4:

• lint: only the two established optional-chain warnings
• production/development typecheck and primary LSP checks
• 1,049 tests; coverage run also 1,049 tests, 96.53% functions
• 18 property tests
• build and 119-file package smoke, including public API consumer compilation
• npm audit: zero vulnerabilities; git diff --check clean
• live workflow evolution: passed, nine tool calls
• live action-first task backlog: passed, seven tool calls

The first live evolution attempt completed its tool sequence but failed the existing initial-plan wording assertion because generic Handoff: task-description labels match its banned-word check. One unchanged retry passed. The failure is retained in the local validation ledger; no test or production code was changed.

Local validation used Node 26.8.1/npm 11.19.0. Combined Node 22 Ubuntu/Windows CI is required before merging; earlier individual PR CI is not substituted for combined-head validation.

[Copilot]

🟢 Approval recommended

The changes are constrained to dependency/version manifest updates that match the stated batch upgrade and do not modify runtime/source logic.

Pull request overview

This PR batches five reviewed Dependabot updates into master, updating the lockfile to the validated dependency set while keeping changes limited to npm manifests.

Changes:

• Bump @earendil-works/pi-coding-agent and @earendil-works/pi-tui to 0.84.4 (pinned together).
• Update the resolved/locked versions for typebox (1.3.16 → 1.3.20), @biomejs/biome (2.5.9 → 2.5.11), and @types/node (26.2.0 → 26.4.0).
• Refresh package-lock.json to reflect the new transitive dependency graph for the updated packages.

File summaries

File	Description
package.json	Updates direct devDependency pins for Pi agent/TUI and TypeBox to the validated versions.
package-lock.json	Locks updated direct + transitive versions (Biome, Node types, Pi packages, and related dependency graph adjustments).

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.