fix(ts): strictness improvements + CI timeouts

- src/stdio/prompts.ts: replace the forbidden `as any` on the
  selectModule destructure with a scoped `as unknown as {...}` that
  narrows to the two properties we actually use (default + Separator).
  Keeps CLAUDE.md's no-any rule satisfied.

- src/dlx/package.ts: tighten dlxPackage() signature — options was
  declared optional but then immediately `options!`-asserted. Since
  DlxPackageOptions.package is required, calling dlxPackage() without
  options is nonsense; make options required at the type level instead
  of hiding the requirement behind a non-null assertion.

- .github/workflows/weekly-update.yml: add job-level timeout-minutes
  (15 for check-updates, 30 for apply-updates). The apply-updates job
  invokes Claude Code in automation which could hang; step-level
  timeouts (10–15m) were insufficient without a job-level ceiling.

Author: jdalton

.github/workflows/weekly-update.yml

@@ -23,6 +23,7 @@ jobs:
   check-updates:
     name: Check for dependency updates
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     outputs:
@@ -48,6 +49,7 @@ jobs:
     needs: check-updates
     if: needs.check-updates.outputs.has-updates == 'true' && inputs.dry-run != true
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write
       pull-requests: write

src/dlx/package.ts

@@ -307,17 +307,17 @@ function getPath() {
  */
 export async function dlxPackage(
   args: readonly string[] | string[],
-  options?: DlxPackageOptions | undefined,
+  options: DlxPackageOptions,
   spawnExtra?: SpawnExtra | undefined,
 ): Promise<DlxPackageResult> {
   // Download the package.
-  const downloadResult = await downloadPackage(options!)
+  const downloadResult = await downloadPackage(options)
 
   // Execute the binary.
   const spawnPromise = executePackage(
     downloadResult.binaryPath,
     args,
-    options?.spawnOptions,
+    options.spawnOptions,
     spawnExtra,
   )
 

src/stdio/prompts.ts

@@ -29,9 +29,14 @@ import { resolveColor } from '../themes/utils'
 const abortSignal = getAbortSignal()
 const spinner = getDefaultSpinner()
 
-// Modules imported at the top - extract default and Separator
+// Modules imported at the top - extract default and Separator.
+// The @inquirer/select shim exposes the namespaced CJS module, so we
+// narrow instead of `as any` to stay within CLAUDE.md's no-any rule.
 const searchRaw = searchModule.default
-const selectModule = selectModuleImport as any
+const selectModule = selectModuleImport as unknown as {
+  default: typeof selectModuleImport.default
+  Separator: typeof selectModuleImport.Separator
+}
 const selectRaw = selectModule.default
 const ActualSeparator = selectModule.Separator