Modernize dependency toolchain and prune vulnerable packages

[mswilkison]

Summary

• pin the development and CI runtime to Node 22 and Yarn 1.22.22
• refresh the compatible Hardhat 2 / Ethers 5 toolchain and replace Waffle with Hardhat Chai Matchers
• regenerate and prune the Yarn lockfile, removing unreachable legacy dependency trees
• modernize CI actions, use frozen installs, restore the yarn format check disabled in 7dc7cb0, and add a new typecheck gate (TS had no prior type coverage)
• update artifact-export and Tenderly integration paths for the refreshed toolchain

Security impact

• no Solidity, deployment-script, or deployed-contract behavior changes
• old and new toolchains produce identical creation/runtime bytecode and link references for all 34 deployable local artifacts
• projected to close 103 of the current 160 Dependabot alerts after the default-branch refresh; remaining alerts are either Solidity-library work that needs a separate governance-aware change or constraints of the retained Hardhat 2 / Ethers 5 stack
• a complete diff-scoped security review found no reportable patch-introduced findings; newly selected advisory-affected development packages have no reachable vulnerable entry point in this repository

The direct OpenZeppelin Solidity versions intentionally remain unchanged here. Updating them is not mechanical: newer Governor semantics require a separate design and test pass for StakerGovernor authorization behavior.

Validation

• yarn install --frozen-lockfile
• yarn format
• forced Solidity compile (75 files)
• full test suite (380 passing)
• local deployment
• yarn prepack
• mainnet artifact-export prepublish lifecycle
• npm publish --dry-run --network=hardhat
• actionlint and git diff --check
• lock graph integrity: 622/622 entries reachable, with no unresolved or orphan entries