Merge GraphQL and Vitest updates

[Code-Hex]

What changed

This branch pulls in the Renovate updates from #1424 and #1426:

• update graphql to 16.13.2
• update vitest to 4.1.5
• keep the lockfile in sync

It also includes the review cleanup from #1427 follow-up work:

• move the shared Zod helpers to src/zod_shared.ts, since both zod and zodv4 use them
• delete the unused test helper files instead of leaving half-migrated helpers around
• fix the JSDoc lint warning in src/lazy.ts

Vitest 4 exposed a GraphQL module identity problem. The tests were building schemas through one graphql entry and @graphql-tools/* was checking them through another, which trips GraphQL-JS' realm check. The config now aliases graphql to the CJS entry and externalizes it for Vitest, so the test runner uses one GraphQL instance.

Checks

• pnpm install --frozen-lockfile
• pnpm type-check
• pnpm test
• pnpm lint