much update many wow

Bumps the all group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@algorandfoundation/tealscript](https://github.com/algorandfoundation/TEALScript) | `0.106.3` | `0.107.2` |
| [@tsconfig/node22](https://github.com/tsconfig/bases/tree/HEAD/bases) | `22.0.5` | `22.0.6` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.64.0` | `8.67.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |
| [prettier](https://github.com/prettier/prettier) | `3.9.5` | `3.9.6` |
| [rolldown-plugin-dts](https://github.com/sxzz/rolldown-plugin-dts) | `0.23.2` | `0.28.2` |
| [semantic-release](https://github.com/semantic-release/semantic-release) | `25.0.7` | `25.0.9` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.64.0` | `8.67.0` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` |



Updates `@algorandfoundation/tealscript` from 0.106.3 to 0.107.2
- [Release notes](https://github.com/algorandfoundation/TEALScript/releases)
- [Commits](https://github.com/algorandfoundation/TEALScript/compare/0.106.3...0.107.2)

Updates `@tsconfig/node22` from 22.0.5 to 22.0.6
- [Commits](https://github.com/tsconfig/bases/commits/HEAD/bases)

Updates `@typescript-eslint/eslint-plugin` from 8.64.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/eslint-plugin)

Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `prettier` from 3.9.5 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.5...3.9.6)

Updates `rolldown` from 1.2.0 to 1.2.5
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.2.5/packages/rolldown)

Updates `rolldown-plugin-dts` from 0.23.2 to 0.28.2
- [Release notes](https://github.com/sxzz/rolldown-plugin-dts/releases)
- [Commits](https://github.com/sxzz/rolldown-plugin-dts/compare/v0.23.2...v0.28.2)

Updates `semantic-release` from 25.0.7 to 25.0.9
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](https://github.com/semantic-release/semantic-release/compare/v25.0.7...v25.0.9)

Updates `tsx` from 4.23.1 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.12)

Updates `typescript-eslint` from 8.64.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](https://github.com/uuidjs/uuid/compare/v14.0.1...v14.0.2)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: "@algorandfoundation/tealscript"
  dependency-version: 0.107.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: "@tsconfig/node22"
  dependency-version: 22.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: rolldown
  dependency-version: 1.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: rolldown-plugin-dts
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: semantic-release
  dependency-version: 25.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: typescript-eslint
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>

xALGO could not vote: 22 topics x 3 options over 6 escrows needed 309 opup inner
transactions, over what any group can pool. Measured on LocalNet with exec
traces, that vote burned 213,875 opcodes against a usable pooled ceiling of
roughly 171,800 — a hard AVM limit, not under-provisioning.

Store every tally flat: one cell per option across every topic, concatenated in
topic order. A nested uint32[][] pays an ARC-4 offset-table lookup plus a row
decode/encode on every element access, and the vote path is nothing but element
access across two unbounded axes. The same vote now burns 81,810 opcodes (-62%),
and a direct GGovPeriod.vote 4,545 instead of 15,414 (-71%). The instance
program shrank with it, 6,310 -> 5,442 bytes.

The period gains an 'l' box (topicLengths) so vote() can read the shape without
decoding the string-heavy options box; the instance reuses the topicOptionLengths
it already snapshots at syncPeriod.

The SDKs stay the boundary. They flatten ballots on the way in and re-row every
tally they read back, so callers keep [topic][option]: the frontend, the
storybook mocks, the pipeline and every existing test call site are unchanged.
Instance readers take the shape from a getPeriod call added to the same simulate
group (no extra round-trip); the registry's cross-instance reader resolves it per
instance app, cached.

GGovPeriod.vote now sizes its reference padding explicitly. Its ten references
(voter, registry app, four registry boxes, three period boxes) never fit one app
call's eight; that shortfall was covered by accident whenever the opcode-budget
prepend fired, and the flat ballot made a small vote cheap enough that it stopped
firing.

Knock-on constants:
- setReady's topic ceiling rises — 58 -> 78 at 3 options, 78 -> 117 at 2 —
  because the vote event drops 4 bytes per topic.
- Vote-record box MBR drops 1,600 uAlgo per topic.

voteBudget.e2e.spec.ts pins the xALGO shape: it asserts the group's measured
appBudgetConsumed stays under 120,000, then sends the vote, which is what
exercises the budget planner that refused xALGO outright.

BREAKING: the vote selector and the box encodings change together, so deployed
period and instance apps cannot be updated in place — they must be redeployed.

Driving claude in a tape needs an Enter per startup gate and a wait on
/ for [0-9]+s/ because the completion verb is randomised. Telling the model
to skip tools makes it announce that on camera. Wait+Screen only sees the
visible buffer. And an unknown modal is indistinguishable from a hang --
re-run with no waits and read the last frame instead of guessing.

ggov-sdk and frac-delegation-sdk carried byte-identical copies of the machinery
that sizes a write group before sending it - increaseBudget.ts, txnExecutor.ts,
groupUsageFee.ts and noteNonce.ts differed only in a "Verbatim copy of ..."
header. The duplication was always a placeholder: base.e2e.spec.ts pinned the two
copies' cost constants together "until the shared SDK package lands". This lands
it. A new projects/sdk-shared workspace package holds one implementation, plus
what it needs (spendable.ts, the three cost/group-size constants, SenderWithSigner
and SendResult). Both SDKs re-export from constants.ts, types.ts and
registry/index.ts, so no public API and no existing import site moves.

padForRefSlots is deleted from both SDKs. Reference slots are measured off the
same simulate that sizes the opcode budget, so the hand-counted call sites - five
in the frac instance SDK, one in ggov's importFracDelegations - become comments
naming what the executor now measures for itself.

The AVM13 rewrite that prompted this measured far more often than it needed to.
Tracing every simulate, including the one algokit runs inside builder.send(), the
worst case was 16 inside executeTxns, 22 once maker reruns were counted. It is
now 9, and the ordinary paths are measured and pinned by the new executor spec:
a write needing nothing costs 2, an inner-heavy 3-escrow vote 4, the same vote
from a writer below the probe headroom exactly 5.

Four things got it there:

- A ProbeContext caches the probe fee headroom and the min fee for one run. A
  low-balance sender used to rediscover its headroom on every probe - up to 6
  extra simulates and 7 accountInformation calls - and now pays for it once.

- A read cache threaded through the *MethodBuilderArgs interfaces. The executor
  owns one per run and escrowCountUpperBound memoises getEscrows (a simulate) in
  it, so the maker's reruns stop re-reading. Measured at -2 on the 3-escrow vote
  by disabling it and re-running.

- The opup count and the usage fee are both decided before the builder is touched
  again, collapsing three maker reruns into one.

- When the usage fee is owed and no probe has passed yet, the search spends its
  last slot on itxnsHi, which is safe by construction and therefore passes - so
  the fee read costs no simulate of its own. The send-time backstop re-prices
  from the rejection's own usage= figure rather than probing again.

Four bugs fixed. Two came out of review:

- txnCount held a Promise, because composer.count() was never awaited. builder is
  any, so tsc was happy, and the MAX_GROUP_SIZE guard silently compared NaN.

- staticFee undershot by (itxnsHi - itxns) * 1000 whenever the search narrowed,
  because it was read off a group built at itxnsHi. It is now the exact identity
  required - (groupFeesPaid - headroomFee), everything the group pays apart from
  txn 0, which holds whatever txn 0 was built with.

Two more only surfaced once ggov-sdk ran on this code - frac's own methods
happened to mask both:

- A dropped prepend. planGroupExtras re-solves with one prepend when the bare
  group is over budget, and that prepend's +700 drives itxnsHi back to 0 - but
  the bail-out guard only tested itxnsHi === 0, so it returned undefined and
  discarded the very prepend that made it zero. Every frac method needing an opup
  also needs reference pads, so padsForRefs > 0 kept the guard from firing there;
  ggov's addTopic and ingestGovs, over budget by less than one app call's worth
  and needing no pads, hit it immediately.

- An inner-txn ceiling that rejected working groups. The guard allowed 16 opup
  inners per transaction in the group, so a ggov vote across 78 topics - 135
  itxns, which the old sizing produced and the network accepted - was refused
  client-side. Opup inners are app calls sharing the group's 256-app-call
  allowance, not a per-transaction quota, and are sized against the group total
  now, consistent with MAX_GROUP_BUDGET = 700 * 256.

SenderWithSigner gains an optional emptyTxnSigner so the sizing simulates can
carry a post-quantum envelope: the v13 PQ premium is priced off the signature,
not the sender address, so a plain empty signer measures a PQ writer's group as
classic. writerFromAddressWithSigners adapts algosdk's PQ/Falcon signing accounts
to the writer shape. Degrades safely without it - the send-time fee retry catches
the shortfall at the cost of one round trip - which is what the frontend does,
since use-wallet exposes neither the scheme nor the public key.

Build orchestration: sdk-shared is registered in the workspace .algokit.toml
build list between contracts and the two SDKs that consume it, and carries its
own .algokit.toml so the unordered commands find it. CI's explicit --project-name
build lists would have failed without it (tsc cannot resolve types with no dist),
and its change-path filters used [^/]+-sdk, which does not match sdk-shared - a
change to the shared package would have skipped the contracts, committee-uploader
and pipeline jobs entirely. The frontend and storybook CDs now build with
pnpm --filter 'ggov-sdk...', whose trailing ellipsis pulls the dependency in
topologically instead of naming it again.

base.e2e.spec.ts's cross-SDK constant sync test is gone: one constant, one pin.

Rebased onto feat/testnet-mirror-seed, whose approval upload had meanwhile moved
to three pages. The two lines of work disagreed on a fact, and the disagreement
is settled by measurement rather than by picking a side: a box reference grants
2048 bytes of I/O budget, not 1024, ref-swept on localnet at every boundary
(2048 -> 1 ref, 2049 -> 2, 4096 -> 2, 4097 -> 3, 6145 -> 4), and resource
population does add more than one reference per distinct box - simulate reports
the shortfall as extraBoxRefs and the populator materialises them. So the
hand-computed machinery the three-page upload carried (BOX_IO_BYTES_PER_REF,
boxIoRefsFor, boxIoRefsPerCall spreading 12 references across companion calls,
approvalReadRefSlots padding the create path, and the probe -> staticFee round
trip) is redundant at best and 2x over-provisioned at worst. The three-page ABI
stays; the sizing goes to the executor, which measures what simulate actually
reports.

drawtext cards look like conference slides. The website promo's cards were
HTML rendered through headless chromium, which is why they looked better --
brass rule, spaced kicker, big statement with an amber payoff line, CSS
scanlines. make-card.sh makes that repeatable and scales the type to the
frame, so a card matches its tape size instead of being letterboxed.

Also record two things that cost a session each: vhs needs ttyd installed,
and a shell segment must set the terminal background to the brand ground or
the cut to a TUI segment visibly jumps.