fix(deps)!: attempt core, extension-link major upgrade — verification failed, needs review (Aikido)

[molon]

Summary

This is an attempted fix that does not pass verification yet. It is opened as a draft so the failure is visible and reviewable, not to be merged as-is. See What fails below.

Upgrade dependencies with known vulnerabilities reported by Aikido Security:

• @tiptap/core: 2.27.2 → 3.29.2
• @tiptap/extension-link: 2.27.2 → 3.29.2

Aikido findings resolved

Finding	Severity	Location
AIKIDO-2026-801631	53	ui/vuetifyx/vuetifyxjs/pnpm-lock.yaml
AIKIDO-2026-484358	22	ui/vuetifyx/vuetifyxjs/pnpm-lock.yaml

Covers 2 Aikido sub-issues across 2 finding groups. Some sub-issues are detections inside built container images; they clear once the image is rebuilt from this change.

What fails

Resolved versions were checked against the lockfile / module graph — not just the manifest edit, because a bumped manifest can still resolve to the old version when another constraint pins it:

• @tiptap/extension-link → 3.29.2 (wanted 3.29.2, via lockfile (ui/vuetifyx/vuetifyxjs))
• @tiptap/core → 2.27.2 (wanted 3.29.2, via lockfile (ui/vuetifyx/vuetifyxjs))

Build does not pass after the upgrade:

• pnpm build in ui/vuetifyx/vuetifyxjs　(same command passes on the base commit, so this is caused by the upgrade)

                                                                Type '(this: { name: string; options: ExtendedOptions; storage: ExtendedStorage; editor: Editor; type: MarkType; parent: (() => Partial<RawCommands>) | undefined; }) => Partial<...>' is not assignable to type '(this: { name: string; options: ExtendedOptions; storage: ExtendedStorage; editor: Editor; type: NodeType; parent: (() => Partial<RawCommands>) | undefined; }) => Partial<...>'.
                                                                  The 'this' types of each signature are incompatible.
                                                                    Type '{ name: string; options: ExtendedOptions; storage: ExtendedStorage; editor: Editor; type: NodeType; parent: (() => Partial<RawCommands>) | undefined; }' is not assignable to type '{ name: string; options: ExtendedOptions; storage: ExtendedStorage; editor: Editor; type: MarkType; parent: (() => Partial<RawCommands>) | undefined; }'.
                                                                      Types of property 'editor' are incompatible.
                                                                        Type 'Editor' is missing the following properties from type 'Editor': className, editorView, destroyed, editorState, and 5 more.
 ELIFECYCLE  Command failed with exit code 2.

What a reviewer needs to decide: whether this upgrade is worth doing now (and who adapts the breaking changes), or whether it should wait. The alternative is to keep the current vulnerable version.

Build passes: pnpm install in ui/vuetifyx/vuetifyxjs

Already failing on the base commit (verified by re-running the same command on 64587dfd4), unrelated to this change:

• pnpm test:unit in ui/vuetifyx/vuetifyxjs

Notes

• One PR per repository, as agreed; commits are split per logical change.
• This PR is not merged automatically and touches no release-* branch.