[Ford544]

• Align TypeScript to 5.5.4 everywhere
  • typescript in package.json pinned to 5.5.4 (was ^3.8.3)
  • rules_ts now reads the version from the lockfile (ts_version_from = "@npm//:typescript/resolved.json") instead of a hard-coded ts_version
• Upgrade rollup 2 → 3 and rollup-plugin-dts 1.4 → 6.4 (required for TS 5)
  • Rollup configs renamed to .mjs (rollup 3 no longer transpiles ESM configs)
• Replace @typescript-eslint/parser v5 with typescript-eslint v8
  • Removed the ESLint 10 compatibility shim from eslint.config.js
  • Enabled type-aware linting (projectService)
  • //:eslint data updated to the new package
• Restore promise checks dropped with tsetse
  • Enabled @typescript-eslint/no-floating-promises and @typescript-eslint/no-misused-promises (checksVoidReturn: false)
  • Fixed the two findings: promise-truthiness checks in cli/api/commands/run.ts and testing/runner.ts replaced with explicit undefined comparisons
• Provide type information to ESLint in scripts/lint
  • Runs pnpm install --frozen-lockfile first (also fails CI on a stale lockfile)
  • Builds //protos:ts and //core:version, the generated sources df/* imports resolve to