Move every pin that can move, and make the rest checkable

[mtoy-googly-moogly]

Move every dependency that can move, and make each one that can't say why in a form the next person can check.

Three of the five "held because it breaks this repo" entries turned out to rest on a wrong diagnosis, so they came out:

• postgres (Postgres connector: pg / pg-cursor / pg-query-stream must move as a coupled set #2928) was never a pg/pg-cursor version skew. pg 8.8 added an exports map, and jest resolves subpaths through its own resolve.exports — 1.x, which cannot match subpath patterns. Node resolved pg/lib/result.js the whole time. Jest 29.7 (already in range) brought 2.x and the hold evaporated.
• vscode-textmate (Stop reaching into vscode-textmate internals in generateMonarchGrammar — fix it properly #2918) deep-imported type modules that 9.3.2 doesn't export. The generator reads a TextMate grammar .json, so it now declares that file's shape itself — a contract that survives whatever upstream does with its internals. Generated malloy.monarch.ts is byte-identical.
• vega was half-released already: vega moved to 6, vega-lite stayed on 5 and dragged its own vega 5 along, which is where the three high advisories lived. vega-lite 6 peers on vega ^6, so there is now one vega and no advisory. No renderer code changed.

Also taken: jest 30, vite 8, peggy 5, jasmine-core 7 (which retires the @types/jasmine tracking ignore), vscode-oniguruma 2, every in-range minor and patch, and the two advisories a direct dep could clear (mysql2, toml). Six dependencies nothing imports are deleted.

Prod npm audit goes 27 → 18, high 14 → 6. Every remaining high and critical reconciles to the snowflake or databricks hold.

Four things did not move, and the ledger now says why in terms that can be re-tested rather than believed:

• BigQuery — the entry said jest could never load gaxios 7's ESM-only dynamic import. It can: name the importer and its target and the whole auth path runs live queries on bigquery 9. What actually blocks the bump is projectId — the connector reads it synchronously in a constructor and the v8/v9 SDK resolves it asynchronously. The hold waits on us, not on vitest.
• Node — the 24.17 keep-alive regression is fixed in 24.18.0, but the BigQuery suite on any post-24.16 Node takes an intermittent jest-worker SIGSEGV: 0 in 16 runs on 24.16.0, 2 in 8 on 24.18.0, 2 in 16 on 24.21.0, same tree. precheck is clean on all three. Cause not established; the measurement is. This one now costs us a security release, so it wants an owner.
• snowflake / databricks — boundaries re-verified rather than assumed. snowflake-sdk@3.3.0 bundles nine .node binaries with an empty optionalDependencies; @databricks/sql@2.1.0 uses the other shape, eight per-platform kernel packages. The ledger now carries the two commands that show this, since no metadata field does.
• apache-arrow — new hold. @duckdb/duckdb-wasm and @motherduck/wasm-client both require ^17.0.0, so raising ours leaves the tree invalid and our typings a major ahead of the values duckdb-wasm returns, with the build green throughout.

On the open-PR limit hiding things: it does, and turning security auto-updates off is what gave it teeth. GitHub exempts security PRs from the cap — but there are none here, so the cap governs everything Dependabot produces, and full means silent. Slots go to whatever is oldest, so an un-ignored major nobody intends to take squats one forever; storybook alone held four of ten. Storybook, jsdom, lerna and gaxios get ignore rows with argued reasons, which frees the queue.

@types/node is left alone — #3002 already syncs it to the runtime major and adds a check so the two can't drift again.

Verified from a clean tree: npm ci, npm run build, npm run build-duckdb-db, npm run precheck (4176 passing of 4270, unchanged), npm run lint. The one snapshot change is jest 30 rewriting its own header URL.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NuuXJ8g133X9wL6MBiyDUf

[mtoy-googly-moogly]

Closing unmerged. The branch dependency-sweep stays pushed if any of it is wanted later.

What's in it: 17 dependencies moved, 6 unused ones removed, 3 holds released (pg #2928, vscode-textmate #2918, vega), prod npm audit 27→18 with highs 14→6, and two CI bugs jest 30 exposed — a bare --reporters in ci-core and ci-test-sanity-check.sh globbing spec files out of node_modules. CI was green across every dialect plus consumer-canary.

Not landing because the pin-ledger half of it is the wrong shape: three of five documented holds turned out to have the wrong cause recorded, so the document was costing more than it returned.