chore(deps): update the state-machine packages to the 2026-10-04 release

[ivanbanov]

Why/What

The state-machine repo shipped its 2026-10-04 release: runtime @dunky.dev/state-machine 0.3.4, and adapter releases (React 0.3.5, Solid 0.3.1, native 0.4.1) that only move their exact pins. This PR moves every package and scaffold template here onto it together. The adapters pin the runtime exactly. A core package left on ^0.3.3 can keep a locked 0.3.3 beside the adapter's 0.3.4. That gives two physical runtime copies (a dependency diamond).

Changes

• Ranges (dependencies unless noted):
  • @dunky.dev/controllable, @dunky.dev/dialog: @dunky.dev/state-machine ^0.3.3 -> ^0.3.4
  • @dunky.dev/dom-dialog (devDependency): @dunky.dev/state-machine ^0.3.3 -> ^0.3.4
  • @dunky.dev/react-dialog: @dunky.dev/react-state-machine ^0.3.4 -> ^0.3.5
  • @dunky.dev/solid-dialog: @dunky.dev/solid-state-machine ^0.3.0 -> ^0.3.1
  • @dunky.dev/native-dialog: @dunky.dev/native-state-machine ^0.4.0 -> ^0.4.1
  • Unchanged: @dunky.dev/state-machine-bindings ^0.4.1 (already latest). -utils 0.4.0 and -dom 0.1.0 come in only through the adapters' exact pins.
• Scaffold templates: core ^0.1.0 -> ^0.3.4 (runtime) and ^0.1.0 -> ^0.4.1 (bindings), React adapter ^0.1.0 -> ^0.3.5, Solid adapter ^0.3.0 -> ^0.3.1, dom-component runtime devDependency ^0.3.3 -> ^0.3.4. On main, pnpm scaffold probe resolved runtime 0.1.0 beside 0.3.3, and two versions each of bindings and the React adapter (pnpm why). Now it resolves one version of each.
• minimumReleaseAgeExclude: lists exactly the four versions published today (2026-10-04T10:01Z). pnpm 11.10 has a default minimumReleaseAge of one day and re-checks every lockfile entry, also with --frozen-lockfile. Without these entries, CI install fails with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION (reproduced). The seven old entries are removed: four name versions that nothing resolves now; bindings 0.4.1, utils 0.4.0 and dom 0.1.0 were published 2026-08-22, so they pass the age check without an entry. A fresh-cache frozen install verifies all 1279 entries and passes.
• Lockfile: only the @dunky.dev state-machine entries change.
• Changeset: patch for controllable, dialog, react-dialog, solid-dialog, native-dialog. dom-dialog gets a patch automatically as a dependent of dialog; its own change is devDependency-only.
• Merges main (chore: upgrade TypeScript to 7.0.2 #56, TypeScript 7). No conflicts.

Behavior: no change expected. The adapter tarballs are byte-identical except version and the exact pins. The runtime .d.ts is byte-identical. The runtime JS changes (after timers through the run-to-completion queue, one frozen boot event, send/setContext as bound fields, live context hosts, for..in props comparison) do not touch what the UI uses: no machine here uses after, watch, state effects, computed or oneOf; the mailbox token is a fresh object; no test spies on send.

Single copy: pnpm why -r finds one version each of @dunky.dev/state-machine (0.3.4), -bindings (0.4.1), -utils (0.4.0), -dom (0.1.0). A fresh node_modules/.pnpm has one directory each. Every consumer (core, controllable, dom-dialog, all three adapters) resolves to the same real path.

Verification (fresh install, merged tree): build (publint 16/16), test:ci (vitest 296/296, native jest 13/13, same as main), typecheck (TS 7.0.2), lint, format:check, changeset status --since=origin/main, and both Storybook builds pass. pnpm knip output is identical to main (only the native findings that #58 addresses).

Issues

None linked. #54 conflicts in packages/{react,solid}/dialog/package.json: it adds dependencies directly above the adapter range that this PR bumps. Keep both edits and run pnpm install on whichever PR merges second.

🤖 Generated with Claude Code