fix(deps): update all non-major dependencies (#542)
* fix(deps): update all non-major dependencies
* fix(ci): keep biome out of .github so autofix.ci can commit its fixes
autofix.ci refuses to push changes under .github. Biome formats YAML, so the
biome 2.6 formatter rewrote .github/workflows/autofix.yml (single to double
quotes) and the whole autofix job failed even though the source-file fixes
were legitimate.
Excluding .github/** from biome's scope states the invariant once: CI
configuration is not a formatter target, so the action can always commit
what the formatter produces.