chore(iac): adopt TypeScript 6.0.3 — tested, unlike the 7.0 proposal

[neosun100]

Dependabot opened TypeScript 6.0.3 right after the 7.0 investigation in #27. Tested the same way — and it came out differently.

version	tsc --noEmit	8 stack tests	cdk synth	verdict
6.0.3	exit 0	8/8	9 stacks	adopted
7.0.2	exit 0	0/8 — die at startup	n/a	blocked (#27)

TS 7 fails with TypeError: Cannot read properties of undefined (reading 'fileExists'): it is the native rewrite and no longer exposes the ts.sys JS surface ts-node reads its tsconfig through. ts-node works fine with TS 6.

So the >= 7 ignore added in #27 is drawn at the measured break point, not at "no major upgrades" — and this is the upgrade it was always going to allow through. Supersedes #28.

The part worth recording

The implicit-@types removal — the cause of the 7 × TS2591 Cannot find name 'process' errors seen during the 7.0 test — actually landed in 6.0, not 7. Verified by removing types: ["node"] under 6.0.3 and watching them come back.

So the one-line tsconfig fix shipped in #27 is precisely what unblocked this upgrade. It was correct on its own terms before either upgrade was attempted — making an implicit dependency explicit paid off one major earlier than expected.

A HIGH alert that cannot be fixed, documented rather than papered over

brace-expansion 5.0.8 (needs 5.0.9)
  node_modules/aws-cdk-lib/node_modules/brace-expansion   inBundle=true

aws-cdk-lib@2.263.0 is the latest published version and it bundles the vulnerable copy. Both remediation routes were tested and neither works:

• npm audit fix reports fixAvailable: true, runs, and leaves the lockfile byte-identical
• overrides: {"brace-expansion": "^5.0.9"} also leaves it at 5.0.8 — overrides cannot reach inside a third-party bundled tarball

Same shape as the earlier bundled-CVE work in this repo. It clears when upstream publishes a cdk-lib bundling 5.0.9. There is no action available here, and claiming otherwise would just repeat npm's own fixAvailable lie.

Testing

• Unit + regression: 3711 passed / 6 skipped
• E2E under TS 6: tsc --noEmit exit 0 · 8/8 stack tests via ts-node · cdk synth 9 stacks
• ruff clean · make ci green (lint / coverage ≥88 / iac synth / secret-scan)