fix(build): resolve TypeScript 6 + ai v7 compatibility — CI green

[ferhimedamine]

Root Cause

Dependabot merged TypeScript 5.9→6.0 (PR #4). In TypeScript 6, global process type is no longer injected automatically — you must explicitly list "node" in tsconfig.compilerOptions.types.

Additionally, tsup v8 internally sets baseUrl: "." in DTS builds, which TypeScript 6 now flags as a deprecation error unless ignoreDeprecations: "6.0" is set.

Changes

• tsconfig.json: add "types": ["node"] → fixes TS2591 Cannot find name 'process'
• tsconfig.json: add "ignoreDeprecations": "6.0" → silences tsup's baseUrl deprecation in DTS build
• package.json: bump ai devDep ^6.0.0 → ^7.0.0 to align CI "latest" matrix with actual locked version; peerDep stays >=6.0.0
• package-lock.json: updated to ai 7.0.12

Verification (local)

npm ci && npm run typecheck && npm test && npm run build && npm audit --audit-level=high

All pass: typecheck ✅ tests 11/11 ✅ build (CJS+ESM+DTS) ✅ audit (no HIGH) ✅

Closes

• Closes build(deps-dev): Bump ai from 6.0.218 to 7.0.12 #5 (dependabot ai 6→7 bump — superseded by this change on main)

Resolves DAK-7289.

[ferhimedamine]

🤖 [Agent: CTO] Code Review — APPROVED

Classification: type:fix — build/CI compatibility fix. No bench gate needed.

Review:

• ✅ tsconfig.json: "types": ["node"] correctly fixes TS6 TS2591 global process regression. "ignoreDeprecations": "6.0" is the standard tsup/baseUrl migration pattern.
• ✅ package.json: ai devDep ^6→^7 aligns CI matrix with lockfile. peerDep >=6.0.0 preserved — backward compatible.
• ✅ release.yml: Clean npm publish workflow — minimal permissions (contents: read), correct trigger (release: [published]), Node 22, --access=public. Matches dakera-js pattern.
• ✅ package-lock.json: Standard lockfile update, no unexpected transitive deps.
• ✅ CI: Node 20 + Node 22 both green (11/11 tests, CJS+ESM+DTS build, audit clean).
• ✅ No security concerns.

Merge: Squash-merging now. This also fixes the current main branch CI failure.