feat: updates to Astro 7, with package updates

[robert-7]

Summary

Routine dependency maintenance plus a major upgrade to Astro 7. Also fixes a pre-existing type error and clears an outstanding CVE. All changes respect the repo's supply-chain policy (minimumReleaseAge, audit gate).

Changes

⬆️ Astro 6 → 7 (feat: updates to astro 7)

• Bumped astro 6.4.8 → 7.0.6.
• Updated the vite override in pnpm-workspace.yaml from 7.3.5 → >=8.0.13 — Astro 7 requires Vite 8, and the old pin broke astro build (rollupOptions.input should not be an html file). Added a comment to bump this on each Astro major.
• Bumped eslint-plugin-astro 1.7.0 → 2.1.1. (v3.0.0 was intentionally not taken — it was published within the 7-day minimumReleaseAge window; upgrade separately once it matures, noting it adds an eslint-plugin-jsx-a11y peer.)
• No astro.config.mjs changes needed — scopedStyleStrategy, image.service, compressHTML: true, and build.format all remain valid in v7.

🔒 yaml CVE (feat: updates yaml to prevent cve)

• Added a yaml: ">=2.8.3" override to patch GHSA-48c2-rrv3-qjmp (stack overflow via deeply nested YAML), pulled in transitively via @astrojs/check. Resolves to 2.9.0.

🐛 Broken education variable (fix: fixes broken education var)

• PrintResume.astro referenced personal.education, which doesn't exist in personal.json (the data has gradEducation / undergradEducation). This broke astro check and rendered an empty Education section in the print resume. Now renders both degrees, matching About.astro.

📦 Routine package bumps (chore: updates packages)

• tailwindcss & @tailwindcss/vite 4.3.1 → 4.3.2
• @types/node 26.0.0 → 26.1.0
• @typescript-eslint/parser 8.61.1 → 8.62.1
• eslint 10.5.0 → 10.6.0

Validation

• ✅ astro check (typecheck) — 0 errors, 0 warnings
• ✅ eslint . — clean
• ✅ astro build — 5 pages built under Vite 8 + Astro's new Rust compiler
• ✅ Built HTML verified — correct title, both education lines render, blog posts generated
• ✅ pnpm audit — no known vulnerabilities

Follow-ups

• Bump eslint-plugin-astro to v3 once it clears the 7-day maturity hold (adds eslint-plugin-jsx-a11y peer).