chore: adopt org tsgo stack (TS7 + @systemfsoftware/tsconfig base + @effect/language-service)

[kiro-systemf]

Brings qmd onto the System F Software standard tsgo toolchain.

What changed

• tsconfig.json now extends @systemfsoftware/tsconfig/tsc/no-dom/library (Node library, no DOM, standalone — not monorepo/composite) and adds the @effect/language-service plugin. Dropped the dead jsx: react-jsx / allowJs (no JSX or .js sources exist).
• tsconfig.build.json extends the local base and sets rootDir: "src" for a deterministic declaration emit (TS7 is stricter — TS5011). declaration/sourceMap now come from the base.
• Toolchain devDeps pinned directly (qmd has no pnpm catalog): typescript ^7, @effect/tsgo ^0.50.0, @effect/language-service, @systemfsoftware/tsconfig ^2.0.1, oxlint-tsgolint 7.0.2001, @types/node ^24. peerDependencies.typescript → ^7 (full upgrade, no dual-compiler).
• Source migration to the stricter base, no runtime behavior change:
  • noPropertyAccessFromIndexSignature — index-signature reads (process.env.X, parsed-arg bags) rewritten to bracket access.
  • exactOptionalPropertyTypes — optional properties/params on the public option/result types (and a few inline signatures) widened to accept undefined; two Required<…>/resolver return types made concrete.
  • No TS5 compiler-API usage existed, so nothing to port there.

Verification (local)

• tsc -p tsconfig.build.json --noEmit → 0 errors (also 0 on tsconfig.json), under TypeScript 7.0.2.
• oxlint → 0 warnings, 0 errors.
• node scripts/build.mjs → clean dist/ with .d.ts + sourcemaps.
• Vitest Node suite: 1245 passed. The only local failures are environment artifacts (git commit.gpgsign with no local key; one sandbox-filesystem test that is green on main's CI) — none introduced by this change.

Lockfiles: bun.lock regenerated for the CI Bun job (bun install --frozen-lockfile); the stale committed pnpm-lock.yaml was refreshed to match package.json.