Deps: lefthook 2.1.17 and typescript-eslint 8.71.1 (#101)

## Summary

Dependency sweep: takes the two dev-tool patches available, lefthook
2.1.17 and typescript-eslint 8.71.1. Nothing else in `bun outdated` is
behind except eslint 10 and TypeScript 7, both held org-wide in the
dependency holds registry; their lift conditions were re-tested today
and still hold (eslint-plugin-import's eslint peer stops at ^9;
typescript-eslint caps TypeScript below 6.1). The lockfile scans clean
with osv-scanner. Dev dependencies only, so nothing shipped changes and
no release follows.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None.

## Test plan

Lint, typecheck, knip, the full test suite and the build all pass
locally on the bumped lock, and a second `bun install` is a no-op.

## Worked with

Varun

## Out of scope / what I did not do

- eslint 10 and TypeScript 7: held org-wide by the dependency holds
registry, lift conditions re-tested today and unmet.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

bun.lock

@@ -59,10 +59,10 @@
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-unused-imports": "^4.4.1",
     "knip": "^6.39.0",
-    "lefthook": "^2.1.16",
+    "lefthook": "^2.1.17",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.0",
+    "typescript-eslint": "^8.71.1",
     "vitest": "^5.0.3"
   },
   "packageManager": "bun@1.4.2",