Upgrade to Backstage 1.55.3 and modernize toolchain

[kwent]

Summary

Upgrades the processor to Backstage 1.55.3 and refreshes the toolchain. Also adds CI.

Supersedes #65 #66 #67

Backstage 1.29.2 -> 1.55.3

• @backstage/plugin-catalog-node 1.19 -> 2.2.5, @backstage/backend-plugin-api -> 1.10.1, @backstage/catalog-model -> 1.10.1, @backstage/plugin-catalog-common -> 1.2.0, @backstage/cli -> 0.36.6, @backstage/cli-defaults -> 0.1.6
• backstage.json -> 1.55.3
• Code change: catalog-node 2.0 moved catalogProcessingExtensionPoint from /alpha into the main entry point (and removed it from /alpha), so src/module.ts now imports it from @backstage/plugin-catalog-node. The module already used the new backend system (createBackendModule, default export), so nothing else changes.

Dependency cleanup

• Removed winston, yn, @backstage/config. They were only used by an unused, unexported legacy PluginEnvironment type (src/types.ts), which is also removed.
• @types/node 20 -> 24 (matches the Node 24 runtime). jest, jest-mock, @jest/environment-jsdom-abstract -> 30.5.2
• jsdom stays on 27.x: @backstage/cli 0.36.6 declares the peer jsdom: ^27.1.0, so Bump jsdom from 27.4.0 to 30.1.1 #65 (jsdom 30) isn't applied.
• typescript stays on 5.9.3. TS 6/7 are out, but the typescript-eslint 8 used by the Backstage CLI doesn't support them yet.
• @rootly/backstage-plugin-common stays on ^1.4.1.
• Dropped the esbuild resolution, because backstage-cli flags it as obsolete during the build.
• zod, msw, supertest and node-fetch were already removed in 1.3.2, so there was nothing to bump.

Toolchain / repo

• Yarn 4.9.2 -> 4.13.0 (packageManager, .yarnrc.yml, .yarn/releases). mise.toml: node 24, yarn 4.13.0
• New .github/workflows/ci.yml runs on PRs and pushes to master: install (immutable), tsc, lint, test, build. Actions are SHA-pinned to the same versions as publish.yml (checkout v7.0.1, setup-node v7.1.0; publish.yml bumped to setup-node v7.1.0 too and still publishes via npm OIDC trusted publishing with --provenance and no token), with permissions: contents: read.
• Removed the root dependabot.yml. GitHub only reads .github/dependabot.yml, which already groups minor and patch updates for npm and covers github-actions.
• dist/ was rebuilt to keep the committed-dist convention.

Version: 1.4.0 (minor)

Consumers install it the same way (backend.add(import('@rootly/backstage-plugin-entity-processor'))). The supported baseline is now Backstage 1.48+ (catalog-node 2.x). The CHANGELOG and README say so, and the README yarn add commands now use modern Yarn syntax.

Test plan

• yarn install --immutable
• yarn tsc
• yarn lint
• yarn test (the package currently has no test files)
• yarn build
• CI green