Take vitest 4.1.11 and cut 2.7.6

[vvillait88]

Summary

Workspace dependency sweep for this repo. vitest and @vitest/coverage-v8 move
4.1.10 to 4.1.11. Both are devDependencies, so nothing here reaches a consumer.

The version bump to 2.7.6 is deliberate rather than required: nothing in this diff
obliges a caller to act. It exists so the SDK ships as tier 1 of a coordinated
release across the SDKs, the commerce libraries and pay, which was Varun's call
after I flagged that by the usual "bump only where a consumer must act" rule this
repo did not need a release at all.

Held deliberately, with registry entries already covering them: eslint 10 and
TypeScript 7 both stay on the 9.x and 6.x lines.

Worked with: Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No exported type, function signature, wire format or response shape changes
in this diff. The only non-lockfile edit is the version field.

Test plan

Ran the repo's full gate set locally on this branch:

• bun run typecheck clean
• bun run lint clean (eslint, max-warnings 0)
• bun run test: 7 files passed, 1 skipped; 166 tests passed, 9 skipped
• osv-scanner over bun.lock: no issues found across 504 packages

No tests were added or changed, because no behavior changed.

Checklist

• Tests cover the new behavior, and the suite passes locally
  (no new behavior; the existing suite passes unchanged on 4.1.11)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
  (public surface did not change, so nothing to update)
• No secrets, credentials, or personal data in the diff or the tests

Deliberately not done

• Consumer floors are not raised to ^2.7.6 anywhere. That version does not exist
  on npm yet, so raising a floor now would make bun install unresolvable in every
  consumer. The existing ranges already accept it, so no consumer edit is needed;
  pinning to the exact tested combination is a follow-up after this publishes.
• No tag pushed. The publish workflow fires on v*, and that is permanent, so the
  tag is left for a deliberate step after this merges.