build: pin attw + override fflate to fix integrity-checks

[amix]

Context

npm run integrity-checks (and so prepublishOnly) was crashing in the attw step with Cannot read properties of undefined (reading 'filename').

Root cause: fflate 0.8.3 (released 2026-05-16) broke @arethetypeswrong/core's tarball decompression — its Gunzip shim only captures the last chunk, and the new fflate emits more than one for our tarball.

What was changed

• Pin @arethetypeswrong/cli@0.18.2 as a devDependency so the attw binary is locked alongside its transitive deps.
• overrides.fflate = "0.8.2" to roll the bad transitive back.
• Drop the npx from the attw script — we have a local copy now.

Verified

npm run integrity-checks green again. attw reports 🟢 on node10 / node16 (CJS+ESM) / bundler.

[scottlovegrove]

Oof, I'd already done this on the Todoist SDK and never even thought about fixing it for Twist (which will still need this fix as well).

[doistbot]

Thank you for quickly addressing the build failure during integrity checks by pinning the @arethetypeswrong/cli dependency and overriding the broken fflate transitive dependency. These adjustments effectively restore the reliability of the prepublish pipeline. It was noted that scoping the fflate override specifically to the affected tool, rather than applying it globally, would prevent unintended constraints on future dependencies.

_{Share Feedback • Review Logs}