chore(deps): bump semantic-release to v25 (clears sigstore advisory, 16→15) (#3408)

* chore(deps): bump semantic-release to v25, @semantic-release/github to v12

Clears the sigstore dev/CI-only advisory (16→15). Both are dev-only
release-tooling deps; release.yml already runs Node 22 (satisfies
semantic-release@25 engines). syncpack intentionally left at ^13.0.4 —
v15 silently ignores .syncpackrc.json's lintRules.forbiddenDependencies
(supply-chain guard) and dependencyTypes, so it is not a safe drop-in.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ui): build without the glob package (fixes framework-editor build)

The semantic-release bump perturbed the dependency graph enough to shift
bun's hoisting so that packages/ui's tsup build loaded an ESM
brace-expansion@5 against a CJS balanced-match@1.0.2 (no named 'balanced'
export), crashing @trycompai/ui#build on Vercel (framework-editor).

Root cause is a latent fragility: packages/ui pulled 'glob' into its build
in two places — tsup.config.ts (ESM import evaluated by bundle-require) and
scripts/generate-exports.cjs. glob→minimatch→brace-expansion's balanced-match
resolution is hoisting-dependent, so any dep-graph change can trip it.

Remove glob from the ui build entirely:
- tsup.config.ts: pass entry globs directly; tsup expands them via tinyglobby
  (picomatch/fdir), no brace-expansion.
- generate-exports.cjs: manual recursive fs.readdirSync walk (withFileTypes,
  Node>=10; sorted for deterministic output).

Verified: turbo build 20/20; dist file list + generated exports content
unchanged (exports now alphabetical, deterministic across rebuilds).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ui): skip dotfiles in generate-exports to match glob semantics

The manual readdirSync walk enumerated every entry, whereas the previous
glob.sync('**/*.js') excluded dotfiles/dot-directories by default (dot:false).
Skip dot-prefixed entries so a stray .something.js or .hidden/ in dist/ can't
leak into package.exports. No change to current output (dist has no dotfiles).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: Marfuen