Deferred dependency updates that need source changes #2149

Description

A broad dependency sweep brought most of the tree to the latest versions, but seven package updates
were held back because each one needs source changes rather than just a version bump. This epic
collects those follow-ups so they can be picked off one at a time instead of blocking a routine
update round.

Everything that updated cleanly is already done — this is only the remainder.

High-Level Plan

Each child is independent and can land on its own:

• oxc toolchain (oxlint, oxfmt, oxlint-tsgolint) — newer versions report violations to fix
• vitest 5 — matcher types no longer resolve, plus an order-dependent test failure it exposes
• jotai 3 — a removed import subpath and the type errors that follow from it
• crypto-js — deprecated upstream with no newer version, so it has to be replaced

Ordering suggestion: the oxc toolchain and crypto-js work are self-contained. vitest 5 and
jotai 3 both need investigation before the size of the change is clear.

Related Issues

• Children are linked as sub-issues below