build: apply the lost PR #14 bumps, drop dead resolutions, fix docs

[irbisadm]

Three unrelated cleanups that came out of the Dependabot sweep.

1. Apply the dev-dependency bumps from the closed #14

Dependabot closed #14 on its own with "Looks like these dependencies are
updatable in another way, so this is no longer needed", at the exact minute it
rescanned the repo after #15 merged. That was a misfire — none of the six bumps
had been applied, so the update was silently dropped. Redone by hand:

Package	From	To
@semantic-release/changelog	6.0.3	7.0.0 (major, native ESM)
@semantic-release/git	10.0.1	11.0.1 (major, native ESM)
@types/node	26.1.1	26.2.0
rollup	4.62.2	4.62.4
semantic-release	25.0.7	25.0.9
typescript	5.1.6	5.9.3

Both majors declare engines: node ^22.22.2 || >=24.15, and @semantic-release/git
really does need Node 22 — it uses Set.prototype.union, which does not exist
earlier. Verified directly: the plugin fails to import on Node 20 with
TEXT_ENCODINGS.union is not a function and imports cleanly on 22 and 24.

That requirement is met where it matters. The plugins only ever execute in
release.yml, which runs Node 22. ci.yml stays on Node 20 on purpose — it
exercises the package near the lower bound of the supported range and never
runs semantic-release. Yarn does not enforce engines without
--engine-strict, so installing on Node 20 is unaffected, and
yarn install --frozen-lockfile passes there.

TypeScript 5.9.3 regenerates types/index.d.ts byte for byte identically. The
dependabot config already pins TypeScript to 5.x, so this stays inside it.

2. Drop two resolutions that never applied

@rollup/pluginutils/picomatch and micromatch/picomatch never matched
anything — Yarn 1 resolves resolution paths from the root of the tree, and the
real chains are @rollup/plugin-replace -> @rollup/pluginutils -> picomatch
and @semantic-release/git -> micromatch -> picomatch.

They are deliberately removed rather than repaired. @rollup/pluginutils
appears twice in the tree: 5.0.3 wants picomatch@^2.3.1 while 5.4.0 (via
@rollup/plugin-typescript) wants ^4.0.2, so a working
**/@rollup/pluginutils/picomatch would drag both down to 2.3.2 and break
plugin-typescript. Pinning the full path merely delays the same trap until
plugin-replace moves to a newer pluginutils.

Nothing is lost: the only consumers of the 2.x line ask for ^2.3.1, and 2.3.2
is the newest 2.x release, so yarn already picks the patched version. Removing
both and reinstalling leaves yarn.lock unchanged byte for byte.

3. Fix the testing section of CLAUDE.md

It claimed no test runner was configured. Vitest runs 55 tests across 12 files,
locally and in CI. Also documents two things easy to get wrong: the randomised
algorithms are only tested on one- or two-element inputs (anything larger can
hang CI forever), and assertions target each joke's documented contract rather
than sortedness. Adds the Node 20 vs 22 split between the workflows, since the
failure mode is otherwise cryptic.

Verification

• yarn build passes, types/index.d.ts unchanged.
• yarn test — 55 tests across 12 files, all passing.
• yarn install --frozen-lockfile clean on Node 20.