- extract_tarball_gz: skip symlink/hardlink tar entries (path-traversal via a
  symlink to an outside dir + a file nested under it, on arbitrary registry/@jsr
  content).
- Rebase the user's compilerOptions.paths + baseUrl onto .deno/ (the generated
  tsconfig lives one level down); they were copied verbatim, so `~/*`->`./src/*`
  resolved to .deno/src/* and broke every import through a user alias. Dropped
  paths/baseUrl from passthrough; added rebase_onto_deno_dir + test.
- sync_types_command: check node_modules/.deno components on the path RELATIVE to
  the project root, so an ancestor dir named node_modules/.deno no longer filters
  every root away (empty graph, no error).
- ensure_root_tsconfig: edit the existing tsconfig by byte-range splice via the
  jsonc AST instead of re-serializing, preserving the user's comments and
  formatting (previously silently stripped on the first sync).
- strip_top_level_type_decls: bound the leading-comment back-pop to contiguous
  comment lines (an unbounded 'pop until /**' could delete earlier decls), and
  make the type-alias skip track bracket depth so an interior ';' doesn't end it
  early.

Deferred (noted on the PR): resolution flags incl --allow-import (#3),
skipped-remote policy (#4), import-map scopes (#8), @types/node via #35889 (#10).