Maintenance sweep: eslint 10, tsup 9, dev refresh

[vvillait88]

Summary

Maintenance sweep for node-sdk. Dev tooling only; nothing in the published package changes, so this ships without a version bump or release.

• eslint 9 to 10 and @eslint/js 9 to 10. eslint-plugin-import is swapped for eslint-plugin-import-x, whose peer admits eslint 10 with the same rule names, so the config change is one import line. eslint 10's new default rules flagged nothing here. The dependabot major ignore for eslint is removed.
• tsup 8 to 9. tsup 9 depends on esbuild ^0.28.2 directly, so the esbuild override no longer changes resolution: a clean install without it resolves the same single esbuild 0.28.2. The override is removed.
• In-range refresh: vitest and @vitest/coverage-v8 5.0.5, dotenv 18.0.8, lefthook 2.2.2, typescript-eslint 8.71.2.

Worked with Varun, as part of a three-session maintenance sweep.

Not done, on purpose: TypeScript stays on 6. Its hold's lift condition was re-tested and still fails, since typescript-eslint 8.71.2 peers typescript <6.1.0. Actions (checkout v7, setup-node v7, cache v6, setup-bun v2, blacksmith checkout v1) and osv-scanner 2.7.0 are already current.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

Run locally under Node 24: lint, typecheck, knip, test (154 passed, 2 skipped) and build, each exit 0. osv-scanner 2.7.0 over bun.lock reports no issues across 388 packages. The CI matrix covers Node 22, 24 and 26.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests