chore(ast-grep): upgrade to ast-grep 0.45.3

[github-actions]

Stack (root → tip):

• ➡️ chore(ast-grep): upgrade to ast-grep 0.45.3 #334 (you are here)
  • test(ast-grep): make the ast-grep 0.45.3 upgrade land green #337

Upstream ast-grep is ahead of the version this repository pins.

This moves every @ast-grep/cli* pin in packages/cli/package.json
from 0.45.2 to 0.45.3 and regenerates
pnpm-lock.yaml. The pins move together on purpose: the platform
packages are selected by optional dependency, so a straggler left at
the old version is a different ast-grep on one platform than on the
others. sg-detect.cjs fails the run rather than open a partial bump.

Nothing else is edited. The rewrite replaces a version string in pins
it can already enumerate and refuses if the count does not match, so
it cannot add a dependency or reformat the file — the diff below is
eight version strings, a resolved lockfile, and a changeset.

This pull request rolls: if upstream releases again before it merges,
the branch, title, and body are rewritten to the newer version rather
than a second pull request being opened. Push a commit to the branch
and that stops — the workflow will not force-push over a commit it did
not write.

---

Upstream release notes — 0.45.3

https://github.com/ast-grep/ast-grep/releases/tag/0.45.3

• chore(deps): update dependency dprint to v0.57.0 #2916
• feat: add min-severity cli #2917
• fix(outline): anchor fallback signatures to names #2913
• feat(outline): add Markdown heading support #2912
• chore(deps): update dependency oxlint to v1.80.0 #2908
• chore(deps): update dependency @ast-grep/napi to v0.45.2 #2906
• feat: add min-severity cli (#2917) #2720
• fix: ast-grep-ignore must be at first be the frist alphabet to take effect #2909
• chore: update tree-sitter 0.27 bb74529
• fix: fix clippy c6b32d7

Contains #337

#334 moves the @ast-grep/cli* pins to 0.45.3 and touches nothing else. This is what makes that bump correct.

What the pin bump alone left broken

• AST_GREP_VERSION still read 0.45.2, failing engine-version-consistency, the vendor contract's version pin, and the reconciliation marker, which records this constant as the engine the rules are valid against. Bumped, and the marker test's deliberate literal (it exists so an upgrade cannot refresh it silently) refreshed by hand.
• src/generated/ast-grep-rule-schema.json is fetched from the tagged upstream, so it was version-bound. Regenerated for 0.45.3; the only change is the Severity enum's order (off now first, since --min-severity compares severities as an ordered type). Nothing of ours reads the order.
• The severity-vocabulary pin asserted ast-grep's error text in the old order. The vocabulary is unchanged; the pin records the reorder and why.

Full CLI suite after the fixes: 88 files, 1444 tests, all passing. No 0.45.3 regression found: every existing language-alias, kind, $$$, Markdown and binding pin held unchanged under tree-sitter 0.27.

New vendor-contract pins

ast-grep-vendor-contract.test.ts gains an inline ast-grep-ignore comments block. 0.45.3 (ast-grep/ast-grep#2909) stopped treating any comment that contains ast-grep-ignore as a directive; it must now be the comment's first alphabetic text. Nothing of ours writes those comments, but check scans whatever code a project has, so it reaches a user as findings appearing under prose or hints vanishing.

Measured against both binaries (0.45.2 swapped into the platform package path), each case records its side of the bump:

case	0.45.2	0.45.3
// ast-grep-ignore / // ast-grep-ignore: no-eval above a match suppresses it	pass	pass
a prose comment mentioning the directive above a match no longer suppresses it	fail	pass
a prose mention with nothing to suppress no longer yields an unused-suppression hint	fail	pass
anchor is the first alphabetic char: /* */, extra spaces, and // 1. still count; // NOTE ast-grep-ignore is prose	fail	pass
a genuinely unused directive reaches --json=stream as ruleId: unused-suppression, severity: hint, note: null	pass	pass

The two baseline cases were also mutated at the fixture level (directive removed; scope changed) and fail as expected.

Not pinned, deliberately: --min-severity. check has no severity filter and runAstGrepScan passes no such flag, so there is no path by which it reaches a user. Outline changes are not exposed by the CLI.

Changeset

.changeset/ast-grep-0-45-3.md is grown in place (still patch) with the two user-observable directions. No update.md ledger entry: nothing installed under .taskless/ migrates, and the ledger exists only for that.

One aside worth knowing: the repo's own taskless check flagged a wrapped comment line in the new test whose text began with the token, exactly the anchor being pinned. Reflowed.

Stacked on #334 — merges down into vendor/ast-grep/upgrade.