[selimaytac]

Closes #112.

tar is listed in dependencies but nothing imports it: git grep -nw tar on main only finds the tar xz shell command in .github/workflows/verify.yml. The pinned tar@7.2.0 and its subtree (@isaacs/fs-minipass, chownr, minizlib, mkdirp, rimraf, yallist) therefore only add advisories to consumers' installs.

Changes:

• remove tar from dependencies
• pnpm-lock.yaml regenerated with the pinned pnpm@10.25.0 (only the tar subtree is removed)
• patch changeset

Checked locally on Node.js 24: pnpm build, pnpm check:types, biome check, and the Anvil, Server, Pool, Instance, internal and processes tests pass. The Tempo and Alto tests were not run (binaries not installed here).

[selimaytac]

Friendly ping on this one: it only removes the unused tar dependency and its lockfile entries, and it still merges cleanly. Happy to rebase if needed.