chore(workflow): minor upgrade-deps simplifications

- Drop the redundant `[ -s ]` check in `ensure_trailing_newline`. If
  the file is empty, `tail -c1` returns nothing and `[ -n "" ]` is
  already false, so the size check adds nothing.
- Trim the upgrade-deps regex-table comment to the only WHY worth
  preserving (oxlint's trailing `\n` disambiguates from
  oxlint-tsgolint). The callback-signature explanation just narrated
  the code and added noise.
- Add `timeout-minutes: 180` to the `Check upgrade dependencies` step
  as a belt-and-suspenders guard. With `--max-turns 200` and the
  no-polling rule now in place, normal runs finish well under this
  cap; a runaway will be killed by Actions instead of consuming the
  full 6-hour job budget.

Author: fengmk2

.github/scripts/upgrade-deps.mjs

@@ -84,9 +84,7 @@ async function updatePnpmWorkspace(versions) {
   const filePath = path.join(ROOT, 'pnpm-workspace.yaml');
   let content = fs.readFileSync(filePath, 'utf8');
 
-  // Each pattern has exactly one capture group (the current version) so the replace
-  // callback signature is `(match, captured, offset, string)` — no positional ambiguity.
-  // oxlint's trailing \n disambiguates from oxlint-tsgolint.
+  // oxlint's trailing \n in the pattern disambiguates from oxlint-tsgolint.
   const entries = [
     {
       name: 'vitest',

.github/workflows/upgrade-deps.yml

@@ -64,6 +64,7 @@ jobs:
 
       - name: Check upgrade dependencies
         id: check-upgrade-dependencies
+        timeout-minutes: 180
         uses: anthropics/claude-code-action@c3d45e8e941e1b2ad7b278c57482d9c5bf1f35b3 # Claude Code to 2.1.112
         env:
           RELEASE_BUILD: 'true'
@@ -229,7 +230,7 @@ jobs:
           # so guarantee a trailing newline regardless of what the generator wrote.
           ensure_trailing_newline() {
             local f="$1"
-            if [ -s "$f" ] && [ -n "$(tail -c1 "$f")" ]; then
+            if [ -n "$(tail -c1 "$f")" ]; then
               printf '\n' >> "$f"
             fi
           }