chore: adopt TypeScript 7

## Summary

Assessed migrating `typescript` `^6.0.3` → `7.0.2` across all four workspace packages (2026-08-25). **Deferred.** The codebase itself is TS7-ready — typecheck, lint, and tests all pass under 7.0.2 — but declaration emit is hard-blocked by the toolchain: TypeScript 7 ships no programmatic compiler API, and tsup's d.ts pipeline requires one.

## What already works on 7.0.2 (verified locally)

- `pnpm -r typecheck` (`tsc --noEmit`, native Go compiler): clean on all four packages. The existing `ignoreDeprecations: "6.0"` in `tsconfig.base.json` is accepted without error.
- `pnpm -r test`: all pass (vitest transforms via esbuild; no TS-API dependency at test time).
- `pnpm check` (oxfmt + oxlint + typecheck): clean.

## Blocker: d.ts emit

All three published packages (`@coder/ai-sdk-agent`, `@coder/ai-sdk-provider`, `@coder/ai-sdk-sandbox`) build with tsup `dts: true`. tsup 8.5.1 (**the latest release**) bundles `rollup-plugin-dts@6.1.1`, which consumes the TypeScript JS compiler API (`ts.sys`, `ts.createProgram`, ...).

`typescript@7.0.2` is the native (Go) compiler: `main: null`, per-platform binary deps, only `./unstable/*` JS exports, and no stable programmatic API — that is targeted for TS 7.1. With 7.0.2 installed, every package's build dies at DTS:

```
TypeError: Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')
at node_modules/.pnpm/rollup-plugin-dts@6.1.1_rollup@4.53.2_typescript@5.7.3/node_modules/rollup-plugin-dts/dist/rollup-plugin-dts.cjs
(bundled into tsup/dist/rollup.js)
```

## Options considered and rejected (for now)

- **tsup `experimentalDts` (@microsoft/api-extractor):** different declaration-bundling pipeline → would change the published d.ts output for no functional gain, and api-extractor is likewise built on the JS compiler API.
- **Alias `typescript` → `npm:@typescript/typescript6`:** gives tsup a working API but makes `tsc` TS6 again — defeats the purpose.
- **Split toolchain (TS7 for typecheck, TS6 for emit):** two TS majors in devDependencies plus checker/emitter divergence risk; the repo-wide typecheck already completes in ~1s, so the payoff does not cover the complexity.
- **Replace tsup dts with raw `tsc` emit + separate d.ts bundler:** restructures the build and changes the published declaration layout (single bundled `index.d.ts` today).

## Ecosystem readiness

- Standalone `rollup-plugin-dts` (latest) already declares `typescript ^4.5 || ^5 || ^6 || ^7` alongside a `@typescript/typescript6` peer — the compat path tooling is converging on — but tsup vendors its own older copy and has not shipped that support.
- Upstream `vercel/ai` (the `ai` v7 ecosystem we target) still builds with typescript `5.8.3`.

## Re-check criteria — re-assess when any of these lands

1. tsup releases a version > 8.5.1 whose dts pipeline supports TS7 (updated `rollup-plugin-dts` with the `@typescript/typescript6` compat peer, or a pipeline built on the stable TS 7.1 API).
2. TypeScript 7.1 ships the stable programmatic API and tsup/rollup-plugin-dts adopt it.
3. Ecosystem signal: `vercel/ai` moves its toolchain to TS 6/7.

**Retry procedure:** bump `typescript` to `^7.x` in all four packages → `pnpm install` → `pnpm check && pnpm -r build && pnpm -r test` → diff `dist/*.d.ts` of all three published packages against a TS6 baseline (published type surface must be unchanged) → live e2e → PR per AGENTS.md merge protocol.

---
_Generated with [`mux`](https://github.com/coder/mux) • Model: `anthropic:claude-fable-5` • Thinking: `xhigh`_

Re-check tsup and TypeScript releases against the three criteria in this issue, especially stable TypeScript 7 API and updated declaration support. If support lands, bump TypeScript in all four packages, then run pnpm check, pnpm -r build, and pnpm -r test. Done means the checks pass and dist/*.d.ts for all three published packages has an unchanged type surface.

Written by the indexing model from the issue text.