Add pnpm override to force serialize-javascript >=7.0.3, resolving
Dependabot alert #1 (CVE via RegExp.flags and Date.prototype.toISOString).

## Summary
- Adds pnpm override for `serialize-javascript@^7.0.3` to resolve
[Dependabot alert
#1](https://github.com/juspay/kolu/security/dependabot/1)
- The vulnerable `[email protected]` was a transitive dep via
`@rollup/plugin-terser`
- Updated `fetchPnpmDeps` hash in `nix/modules/typescript.nix`

## Test plan
- [x] `nix build` passes

Ralph iteration #1 (issue #440).

**Flake class addressed**: After-hook TypeError cascade — when a scenario
fails from ECONNRESET (or any other browser/server crash during the run),
the After hook's unguarded `this.page.screenshot()` throws
`TypeError: Cannot read properties of undefined (reading 'screenshot')`,
turning one flake into two. Same shape applies to `context.close()` on an
already-torn-down context. Documented in #320, commit bec1500.

**Fix (test-only, per #440 constraint)**: wrap the screenshot path in a
`this.page`-presence check + try/catch, and wrap `context.close()` in a
try/catch. Cleanup failures no longer mask the original scenario failure
in Cucumber's report.

**Measurements (iteration #1)**:
- baseline: 0 CI runs (starting point — full `just ci e2e` loop deferred
  to subsequent iterations due to single-session time budget)
- fix type: defensive guard in `packages/tests/support/hooks.ts`
- lines changed: 1 file, +22 / -4
- no server/client/common code touched
- no timeout bumps

Per Lowy review: canvasMaximized was bundling three independent volatilities
(client UI signal + server module-level state + SavedSession) into one
propagation chain — but no consumer actually needed cross-client awareness.
It's a per-tab view preference, like minimap-expanded.

- Move signal to makePersisted (localStorage) in useViewState
- Drop the createEffect server mirror + maxHydrated ordering hack
  (Hickey #1: temporal coupling between effect and useSessionRestore)
- Drop the field from SavedSessionSchema, SetCanvasMaximizedInputSchema,
  contract, router, server terminals.ts, session.ts, session.test.ts
- Drop hydrate-on-mount + restore-on-button from useSessionRestore
- Revert state.ts to SCHEMA_VERSION 1.15.0 (1.16.0 never shipped)

…a renderer factory

Hickey #1: the virtualization-mode predicate was decided at the
constructor site (vanilla vs. virtualized class) and re-checked at the
render site (containerWrapper vs. fileContainer), with nothing enforcing
that the two branches stay in sync. Extract the pairing into a
`createDiffRenderer` / `createFileRenderer` factory so a future
render-option addition can't be applied to one arm and missed on the
other. Also addresses Hickey #2 (collapsed ternary) and Lowy #3 (the
branch point is now named and commented inside the factory).

…low constraint

Lowy #1: the `class` prop is forwarded to the host element regardless of
virtualization mode, but in the virtualized branch that element IS
Pierre's file container (which lives inside the <Virtualizer>'s scroll
surface). Applying `overflow-*` there silently breaks the
intersection-observer math that drives windowing. Document the
constraint at the prop boundary so a future caller can't ship the
broken combination without seeing the contract first.