docs(deps): record the @types rename trap, and correct the stale dependency notes [skip-ci]

[RonenMars]

Two lessons from the dependabot batch that landed today, plus the stale notes they exposed.

1. A @types/* type imported by name is a version coupling

@types/node 26.5.0 renamed the perf_hooks histogram IntervalHistogram to ELDHistogram, and neither version declares both names.
So #853 failed Lint and Build on TS2305: … has no exported member while nothing was wrong at runtime.

Renaming the import moves the break to the other side of the bump and leaves the same trap for the next rename.
Deriving the type from the value that produces it — ReturnType<typeof monitorEventLoopDelay> — tracks whatever the installed types call it (#874).

Recorded with the verify-both-versions procedure, the revert-to-red check, and the sequencing constraint: the derived-type fix lands on main first, then the dependabot PR rebases green.

2. A green suite does not fully clear a major test-runner bump

vitest 5.0.0 (#855) passed every check across two independent CI cycles.
That is strong evidence, because CI runs the suite under the new runner — but it covers only what the suite exercises, not config resolution, reporters, worker pooling or default timeouts.
Recorded as "suspect the runner first when tooling output turns odd".

3. AGENTS.md "Dependencies and build" was substantially wrong

Found while adding the above. Every claim below was checked against the tree, not copied from CLAUDE.md:

Claim	Reality
vendor/scanner, vendor/agent-types, vendor/menubar are submodules	.gitmodules has only vendor/menubar
CI checkouts "remain recursive"	every ci.yml/release.yml checkout sets submodules: false; only update-menubar.yml is recursive
@threadbase/scanner are file: deps built by postinstall	@threadbase-sh/scanner@^0.17.2 and @threadbase-sh/agent-types@^1.0.0, normal npm semver deps — the scope was wrong too
"only node-pty is external" for the CLI	the CLI entry externalizes node-pty and better-sqlite3; the library entry externalizes node-pty and pg
"both SQLite and Postgres migration copies"	the build copies three dirs: migrations/, runtime-migrations/, pg-migrations/
preserve prepare / postinstall	correct — kept, and noted that prepare also sets core.hooksPath

CLAUDE.md carried the same CLI-externals error and is corrected with it.

Reaching all three tools

Canonical text lives in docs/troubleshooting.md.
CLAUDE.md and AGENTS.md point at it; Cursor reads AGENTS.md natively and additionally gets .cursor/rules/dependency-bumps.mdc, scoped by globs to TS and dependency files rather than alwaysApply.

The .mdc is a short form plus a pointer, not a third copy — three hand-maintained copies of one paragraph is how AGENTS.md drifted in the first place.
Adding it falsified docs/agents/tooling.md's "Cursor … read none of the files above", which is updated here.

Verified state

• npx vitest --version → vitest/5.0.0 darwin-arm64 node-v24.15.0, confirming the runner claim.
• @types/node on main is 26.5.0 (chore(deps-dev): bump @types/node from 26.4.0 to 26.5.0 #853 merged).
• ../../docs/troubleshooting.md resolves from .cursor/rules/; .cursor/ is not gitignored.
• Code fences balanced; biome check clean.

Checked 2026-09-12 against 32a7977d.

Docs-only, hence [skip-ci].

[RonenMars]

🎉 This PR is included in version 1.90.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀