chore(deps-dev): bump changesets, eslint and typescript-eslint (#1901)

Applies dependabot #1898 (lockfile-only: @changesets/changelog-github 1.0.1,
@changesets/cli 3.0.2, eslint 10.10.0, typescript-eslint 8.70.0) plus the two
follow-ups its CI needed: the transitive esbuild 0.28.1 -> 0.28.2 bump in
allowBuilds, and the pnpmDeps hash in flake.nix computed by the Nix job.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

flake.nix

@@ -52,7 +52,7 @@
               inherit (finalAttrs) pname version src;
               pnpm = pkgs.pnpm_10;
               fetcherVersion = 3;
-              hash = "sha256-GnmhEYY/8VX0P10qyIo0XNpg0dseFQlfIB3X48osBJQ=";
+              hash = "sha256-oz4tsfu05IPDMaBBp5jLbfsxvTmw1oVtNFtpvudCOPE=";
             };
 
             nativeBuildInputs = with pkgs; [

pnpm-workspace.yaml

@@ -2,7 +2,7 @@ packages:
   - '.'
 
 allowBuilds:
-  esbuild@0.28.1: true
+  esbuild@0.28.2: true
 
 # The only declaration of these. A `pnpm.overrides` block in package.json does not
 # merge with this list — pnpm 10 uses it *instead of* this file (verified: a lone