deps: typescript held at major 6 — tsup vendors a rollup-plugin-dts that crashes on TS 7 #487

Problem

typescript is pinned to major 6 (pnpm-workspace.yaml catalog: typescript: "^6.0.3"), and .github/dependabot.yml ignores version-update:semver-major for it. TypeScript 7 is current (latest = 7.0.2), so without this issue the pin has no visible owner and the published SDK quietly stays a major behind.

Why it's pinned

tsup cannot generate .d.ts under TypeScript 7.

clients/ts prepare: DTS Build start
TypeError: Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')
    at node_modules/.pnpm/rollup-plugin-dts@6.1.1_rollup@4.53.2_typescript@5.7.3/node_modules/rollup-plugin-dts/dist/rollup-plugin-dts.cjs
    at .../tsup@8.5.1_..._typescript@7.0.2_.../tsup/dist/rollup.js:4857:37

tsup 8.5.1 — the current release — vendors rollup-plugin-dts 6.1.1 into tsup/dist/rollup.js. It is not a lockfile entry. 6.1.1 declares typescript: "^4.5 || ^5.0" and reaches for TS 5-era compiler internals, so it dies the moment dts: true runs.

That is clients/ts's prepare script, which means the crash happens inside pnpm install — so it takes Lint, Unit tests, E2E, Coverage and Docs build down together. Integration tests (Go only, no pnpm) stay green, which is the signature to look for. This is exactly what happened on #482.

Escape hatches already rejected

• pnpm overrides — nothing to override. rollup-plugin-dts is bundled inside tsup's own dist, not resolved from the store.
• patchedDependencies — would mean patching a bundled megafile; unmaintainable across tsup releases.
• experimentalDts (api-extractor) — a real option, but it's a build-pipeline change to the published SDK's type output and does not belong in a dependency bump.

Drop condition

rollup-plugin-dts >= 6.5.0 widened its peer range to typescript: "^4.5 || ^5 || ^6 || ^7" (latest is 6.5.1). The unblock is a tsup release that vendors >= 6.5.0.

When that ships:

1. Bump tsup in clients/ts/package.json.
2. Remove the typescript ignore block from .github/dependabot.yml.
3. Let Dependabot propose the TS 7 major, or bump the pnpm-workspace.yaml catalog directly.
4. Verify pnpm install completes and clients/ts/dist/index.d.ts is generated.

Context

Pinned in the PR that folded Dependabot #480/#481/#482 together and fixed #486. The ignore block in .github/dependabot.yml references this issue.