S3.3 — JS bindings and tooling: wasm-pack 0.15, vitest 5, eslint 10

Intent

The rustwasm org was archived (2025-08); wasm-bindgen and wasm-pack now live under github.com/wasm-bindgen. Bring oxmpl-js and its dev tooling current, and stop TypeScript 7 (Go port, no programmatic API) from silently breaking the formatter.

Acceptance criteria

• wasm-bindgen 0.2.129 / js-sys / web-sys current (lockfile)
• wasm-pack ^0.15.0 devDependency (skip broken 0.14.0)
• vitest 5 with explicit vite ^8 devDependency; vite-plugin-wasm 3.6, vite-plugin-top-level-await 1.6
• eslint 10, @eslint/js 10, globals 17, prettier 3.9, prettier-plugin-organize-imports 4.3
• typescript ^6 pinned as a devDependency
• engines.node ≥ 22.12 in package.json
• npm run format:check, npm run lint, npm test green

Tasks

• Cargo lockfile bump for wasm-bindgen family
• package.json devDependency bumps + regenerate package-lock.json
• Adapt eslint.config.js / vitest.config.js to eslint 10 / vitest 5 breaking changes
• Verify format:check resolves typescript 6, not 7

Source

Agreed in the senior-engineer grilling session 2026-10-08 (decisions in repo docs/planning/adr/0003-motion-validation.md, glossary in CONTEXT.md; toolchain research briefs in the same session).