chore: upgrades and quality gates for 2.16.0

[saby1101]

Everything remaining before 2.16.0 is cut. Stacked on #13; retarget to main once that merges. No version bump here.

Dependency

@google-cloud/storage 7 → 8, the only upgrade still available (TypeScript 7 stays blocked — ts-jest peers <7, and TS 7 ships no lib/typescript.js at all, only a native binary behind a JSON-RPC bridge).

The suite mocks GCS, so it cannot catch an API change. Verified against the real client that all eight methods the code calls still exist: Storage.bucket, bucket.file, bucket.upload, file.exists, file.save, file.getMetadata, file.createReadStream, file.createWriteStream.

Fixes #11 — and a wider version of it

src/types.ts now augments FastifyInstance with FileStore, so consumers get compile-time safety instead of declaring it themselves.

While doing it: nothing imported types.ts. TypeScript only applies a module augmentation if the declaring file is in the consumer's compilation, and index.d.ts never referenced it — so the pre-existing FastifySchema augmentation was dead too. index.ts now imports it for the side effect.

That makes the augmentation live for consumers, which is exactly the risk that kept #11 open. Verified rather than assumed: packed this branch, installed it into a wms worktree, and ran a full build.

wms @ master, baseline                0 errors
wms @ master + this candidate         0 errors, all 23 projects

Type checking in tests

diagnostics: false is gone. It was suppressing TypeScript errors in specs, which is how #11 stayed invisible. Removing it surfaced four unsafe as jest.Mock casts, now as unknown as jest.Mock.

Two things this needed:

• types: ["jest", "node"] in the ts-jest tsconfig override — without it every spec fails with Cannot find name 'describe'.
• Warning 151002 ignored. Its suggested fix (isolatedModules: true) drops index.ts function coverage to 0%, which would defeat the threshold below.

Coverage gate

coverageThreshold pinned at 100 for statements, branches, functions and lines. Coverage was computed and then ignored, so a regression would have merged green. bail: 1 removed so CI reports every failure rather than the first.

ESLint

There was none — Prettier only. Type-aware rules on src, relaxed for file-store.ts and the specs, where SDK error types and mocks are any by nature. Each relaxation is commented.

One finding worth keeping: no-explicit-any pushed toward changing DataStream.on to a narrower element type, which breaks structural compatibility with node's Readable. Reverted with a targeted suppression — the any[] matches EventEmitter deliberately.

Real S3 integration test

file-store.minio.integration.spec.ts runs against actual MinIO: 6 tests covering missing-key handling, round-trip, HeadObject metadata, streaming, and the multipart upload path.

Skipped unless MINIO_TEST_ENDPOINT is set, so the default suite still needs no Docker. This closes a real gap — the mocked suite could not have caught the NoSuchKey/NotFound mismatch fixed in #9.

CI and hygiene

• CI runs lint and build alongside tests
• Sonar moved to pull_request; it previously ran only on push to main, so it could record problems but never block one
• Dependabot now watches npm, grouped by ecosystem with majors kept separate. It watched Actions only, which is how npm-run-all@4, Node 20 and an unused testcontainers sat untouched
• Deleted docs/superpowers/plans/*, describing the event-bus plugin removed in c001efc
• skipLibCheck stays on. Disabling it fails on thread-stream@4.2.0, whose .d.ts references TransferListItem — a name its worker_threads types do not export. Third-party, not ours. The comment claiming it was a @nats-io/jetstream workaround is corrected.

Verification

lint     clean
build    clean
tests    127 passed, 100% statements/branches/functions/lines
minio    6 passed against a real container
wms      builds clean against a packed candidate

Not included

CODEOWNERS. The org ruleset sets require_code_owner_review: true, so the requirement is currently vacuous — but adding the file activates it, and a wrong team name would block every PR. Existing teams are dev-leads, employees, kautilyan-ai, strings-corp, test-unity, verlauf; none is obviously the owner. Needs a decision, not a guess.