chore(deps): update Commander and lint-staged majors

[corwinm]

Summary

• update Commander from 14.0.3 to 15.0.0
• update lint-staged from 16.4.0 to 17.0.8
• refresh the npm lockfile for the new major dependency trees

Compatibility review

• Commander 15 is ESM-only; this repository already uses "type": "module" and ESM imports
• Commander 15 requires Node 22.12 or newer; this repository requires Node 24 or newer
• lint-staged 17 requires Node 22.22.1 and Git 2.32 or newer; the project and CI environments satisfy those requirements
• lint-staged configuration remains in package.json, so its optional YAML dependency change does not apply
• no source or configuration migrations were required

Validation

• npm run fmt:check
• npm run shell:fmt:check
• npm run lint
• npm run shell:check
• npm run typecheck
• npm run check
• npm audit (0 vulnerabilities)
• 127 non-sync tests pass locally
• real staged TypeScript file smoke test through lint-staged 17, including oxlint and oxfmt

npm run test retains the existing macOS-only failure in test/sync-tmux-plugin.test.ts; the same focused failure reproduces on origin/main. Ubuntu CI remains the authoritative full-suite check.

Review scope

This follows the merged safe-range update in #16. The branch is rebased onto current main, so this PR now contains only the Commander 15 and lint-staged 17 delta.