Pin devDependencies to ranges instead of latest

[beogip]

9 of 10 devDependencies use latest, including semantic-release and its plugins which run in the publish path. Reproducibility is protected today by bun.lock + bun install --frozen-lockfile, but a lockfile regen can silently pull a major into the release pipeline. Pin at least semantic-release, its plugins, typescript, and @biomejs/biome to caret ranges.

[claude]

Claude finished @beogip's task in 4m 2s —— View job • claude/issue-20-20260608-0304 • Create PR ➔

---

Task: Pin devDependencies to ranges instead of latest ✅

All four pipeline steps complete. PR #38 is open against main and closes this issue.

• Step 1 — Plan → docs/specs/issue-20-pin-devdependencies-to-ranges-instead-of-latest.md (lean, auto-approved in CI)
• Step 2 — Code: pinned all 10 latest devDependencies to caret ranges from bun.lock
• Step 3 — Review: code-reviewer verdict PASS — 0 findings; every caret base matches the lockfile; scope clean. Attacker skipped (diff below threshold: 1 file, 22 lines).
• Step 4 — Deliver: committed, pushed, PR created & verified

What changed

package.json — latest → caret ranges pinned to the versions already resolved in bun.lock (no version bumps):

package	range		package	range
@arethetypeswrong/cli	^0.18.3		semantic-release	^25.0.3
@biomejs/biome	^2.4.10		@semantic-release/changelog	^6.0.3
bun-types	^1.3.11		@semantic-release/git	^10.0.1
dts-bundle-generator	^9.5.1		@semantic-release/github	^12.0.8
lefthook	^2.1.4		@semantic-release/npm	^13.1.5
typescript	^6.0.2

zod was already ^4.0.0 and was left untouched.

Verification

Check	Result
bun install --frozen-lockfile	✅ exit 0, bun.lock unchanged
bunx biome check .	✅ pass¹
bunx tsc --noEmit	✅ pass
bun test	✅ 113 pass / 0 fail

¹ Biome emits a pre-existing info note that biome.json's $schema (2.4.15) differs from the installed 2.4.10 — this predates the change, is non-blocking (exit 0), and is out of scope for this issue.

Note: the change pins to caret ranges as the issue requested, not exact pins — minor/patch updates are still allowed, while CI's --frozen-lockfile keeps installs reproducible.