* master: (23 commits)
  feat(crates): Add noDevDeps option (#112)
  fix: Write to cache in base artifact provider
  fix: Logger scopes for gcs and artifact providers
  build(ci): Have better defaults for CI environments (#110)
  fix(gha): Use single quotes for string literals (#108)
  ref(gha): Remove ENV inputs, add no-merge and keep-branch (#107)
  fix(docker): Fix CARGO_HOME and RUST_HOME since GHA changes HOME (#106)
  docs: Add missing CHANGELOG entry for cargo upgrade (#105)
  build(docker): Upgrade cargo to a recent version (#104)
  fix(gha): Remove no-merge and keep-branch temporarily
  fix(gha): Try to skip empty args using null
  fix(gha): Remove defaults on craft arguments
  fix(gha): Only pass publish args to publish
  feat(gha): Add GitHub Action for Craft (#103)
  docs: Fix `changelogPolicy` enum (#102)
  build(docker): Add a `craft` binary into the Docker image (#101)
  docs: Fix `artifactProvider` example (#100)
  release: 0.10.0
  meta: Update Changelog
  build(gcb): Add a public Docker image (#99)
  ...

- Remove `rimraf`, `@types/rimraf`, and `@sentry/typescript` dev deps:
  - Replace `rimraf()` call in `files.ts` with Node 22 built-in `fs.rm()`
  - Update `clean` script to use `rm -rf` directly
  - Inline `@sentry/typescript/tsconfig.json` settings into `tsconfig.build.json`
    to eliminate the `tslint` transitive dependency tree
- Add `pnpm.overrides` to force patched versions of vulnerable transitive deps:
  - `minimatch >= 10.2.1` (CVE-2026-26996, High, ReDoS — alerts #111-114)
  - `ajv@<6.14.0 → ^6.14.0` (CVE-2025-69873, Medium, ReDoS — alert #110)
- Add `devalue >= 5.6.3` override in `docs/` (GHSA-33hq/8qm3, Low — alerts #108-109)

## Summary

Fixes 7 open Dependabot alerts by eliminating vulnerable transitive
dependencies where possible, and using `pnpm.overrides` to force patched
versions otherwise.

## Changes

**Removed legacy dev dependencies** (eliminating entire vulnerable
sub-trees):
- `@sentry/typescript` — only used for its `tsconfig.json`; dragged in
`tslint` → `minimatch 3.x` (CVE-2026-26996). Settings inlined directly
into `tsconfig.build.json`.
- `rimraf` + `@types/rimraf` — single call site in `files.ts` replaced
with `fs.rm()` (Node 22 built-in); `@types/rimraf` was pulling
`@types/glob` → `glob@13` → `minimatch 10.x` (vulnerable).

**Added `pnpm.overrides`** to force patched transitive deps:
- `"minimatch": ">=10.2.1"` — fixes alerts #111–114 (CVE-2026-26996,
High, ReDoS). After removing the above deps, all remaining minimatch
consumers are on 10.x, making a blanket override safe.
- `"ajv@<6.14.0": "^6.14.0"` — fixes alert #110 (CVE-2025-69873, Medium,
ReDoS). Pulled in by `eslint` → `@eslint/eslintrc`. Using `^6` (not
`>=`) to stay within the v6 API boundary that eslint requires.
- `"devalue": ">=5.6.3"` in `docs/package.json` — fixes alerts #108–109
(Low, DoS + prototype pollution via Astro/Starlight transitive dep).

## Verification

- `pnpm build`: ✓
- `pnpm lint`: ✓
- `pnpm test`: 884 passing (6 pre-existing e2e failures unrelated to
this change — require `EDITOR` env var for git commits)