Sweep: knip 6.42.1, typescript-eslint 8.72.0, bun 1.4.4 (#110)

## Summary

Maintenance sweep for 2026-10-22. Every change is a dev-only tool
update, so no release.

- **knip:** 6.41.0 to 6.42.1.
- **typescript-eslint:** 8.71.2 to 8.72.0.
- **`packageManager`:** `bun@1.4.4`. CI's setup-bun follows this field.
Bun 1.4.4 drops the compromised emSign ECC Root CA - G3 and rejects
chains containing the blocked keys.
- **Checked and current:** every GitHub Action this repo uses is on its
latest major.
- **Held back:** TypeScript 7. typescript-eslint 8.72.0 still peers
`typescript <6.1.0`, so it would break lint.

Worked with Varun.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

Unchanged. Nothing in the published package changes, so this does not
bump the version or cut a release.

## Test plan

- `bun run lint`, `typecheck`, `knip`, `test` (154 passed, 2 skipped)
and `build` all pass.
- `osv-scanner` on `bun.lock`: no issues found.

## Checklist

- [ ] Tests cover the new behavior, and the suite passes locally (no new
behavior; the existing suite passes)
- [x] Lint, format, and type checks pass
- [ ] Docs and README examples updated if the public surface changed
(the public surface did not change)
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88