chore: upgrade vitest to v3 to clear the dependency audit

npm audit reported 5 vulnerabilities (1 critical, 2 high, 2 moderate), all
transitive through [email protected]: vite -> esbuild, and postcss -> nanoid. They
were dev-only and never shipped — packages publish src and dist alone — but
they were also free to fix.

vitest 3 runs the existing suite unchanged: 687 tests pass, and npm audit now
reports zero vulnerabilities.

CHANGELOG.md

@@ -80,6 +80,11 @@ public API changes with it.
   fingerprint once for the batch. The same pass now takes ~85ms cold and ~6ms
   warm.
 
+- `npm audit` reported 5 vulnerabilities (1 critical, 2 high, 2 moderate), all
+  from `[email protected]`'s dependency tree (`vite` → `esbuild`, `postcss` →
+  `nanoid`). Dev-only and never shipped, since packages publish `src` and
+  `dist` alone. Upgrading to `vitest@3` clears all five with no test changes.
+
 ### Changed
 
 - The evaluator no longer carries application thresholds. The previous invented

package.json

@@ -25,6 +25,6 @@
     "@types/node": "^22.10.0",
     "happy-dom": "^20.11.2",
     "typescript": "^5.4.5",
-    "vitest": "^1.6.0"
+    "vitest": "^3.2.7"
   }
 }