eslint runs again on TypeScript sources under TypeScript 7

## Summary

Restore the `eslint` pre-commit hook, which has not linted anything since the
TypeScript 7 bump.

## Motivation

`eslint.config.cjs:7` requires `@typescript-eslint/eslint-plugin`, and the
plugin hard-refuses TypeScript 7 at load time. Every invocation dies before
linting a single file:

```text
typescript-eslint does not support TS 7.0.
Error: typescript-eslint does not support TS 7.0.
at Object. (node_modules/.../@typescript-eslint/eslint-plugin/dist/index.js:50:11)
at Object. (eslint.config.cjs:7:18)
```

The Pre-commit run on `renovate/typescript-7.x` (18d4be2) failed and the bump
merged anyway as de26c02 (#378). The workflow triggers on `master` while pull
requests target `main` (#369 retargets it), so nothing has re-run it since
2026-07-24 and the breakage stayed invisible. Typed lint rules have been
unenforced across the workspace since.

## Scope

- Pick a route: run typescript-eslint against the TypeScript 6 API side by side,
hold `typescript` at 6 until typescript-eslint ships TypeScript 7 support, or
drop the typed rules.
- Update `eslint.config.cjs` and the `typescript` / `@typescript-eslint/*` pins
in `package.json` to match.

## Acceptance criteria

- [ ] `pre-commit run eslint --all-files` passes and reports linted files rather
than exiting on a plugin load error.
- [ ] Typecheck and lint pass.

## Additional context

- Upstream support tracking:

- #369 restores the CI trigger, so a regression like this surfaces on the next
pull request instead of merging unnoticed.