[backport] typst gather which await v1.10

[cderv]

Note

THis PR is a backport to v1.10

Description

Backport of #14731 to v1.10.

v1.10 carries all four instances of the bug identically: the non-vendored
branch of each dependency's configure callback in
package/src/common/dependencies/ checks if (which(file) === undefined), but
which is async (src/core/path.ts), so this compares a Promise to
undefined — always false, guard never fires.

With QUARTO_VENDOR_BINARIES=false (what conda-forge uses, so binary deps come
from conda packages rather than downloaded release assets), configureDependency
skips the download but still calls configure(). This guard is the only thing
meant to catch a missing binary, so the build reports success and produces a
Quarto tree without it. Confirmed against a real green CI build of quarto
1.10.18 on conda-forge — which is why this matters on the stable branch rather
than only on main. The failure surfaces only at runtime: every Typst render
prints typst-gather analyze failed; staging all packages as fallback: ..., and
quarto call typst-gather dies with a misleading error.

Also refreshes the stale "binary not found" message in typstGatherBinaryPath()
and the dev-call typst-gather command, which told users to
Run ./configure.sh to build and install it. — configure.sh no longer builds
typst-gather (the cargo step and package/typst-gather/ were removed in 1.10;
it is a downloaded release binary), and neither message mentioned
QUARTO_TYPST_GATHER, which both code paths already honour.

Backport notes

Prepared per dev-docs/checklist-backport-a-pr.md:

• The code commit cherry-picks onto v1.10 with zero conflicts in all six
  source files. The only conflict was news/changelog-1.11.md, which does not
  exist on this branch and was dropped, as the checklist prescribes.
• The changelog entry is a separate commit, filed under
  # v1.11 backports > ## In this release in news/changelog-1.10.md per
  .claude/rules/changelog.md.
• This is the first backport of the v1.11 cycle onto v1.10, so that commit
  also introduces the dual top-level structure (# v1.11 backports /
  # v1.10 changes) that the file did not have yet. The pre-existing v1.10
  content is unchanged, just moved under the # v1.10 changes heading.

Checklist

I have (if applicable):

• referenced the GitHub issue this PR closes
• updated the appropriate changelog in the PR
• ensured the present test suite passes
• added new tests
• created a separate documentation PR in Quarto's website repo and linked it to this PR

The checklist step of manually running the test-suite GHA workflow on v1.10
has not been done and is worth doing before merge — nothing in this change
has been built or test-run. Note also that package/src is not covered by any
test suite and no CI workflow runs deno check over it, which is how
Promise<string | undefined> === undefined (TS error 2367) shipped in the first
place.

AI-assisted PR

• AI tool used: Claude Code
• Codebase grounding: local clone — src/core/path.ts (confirmed which is
  async), the four configure callbacks in
  package/src/common/dependencies/, verified against the real v1.10 branch
  that all four instances and the stale error message are present there;
  dev-docs/checklist-backport-a-pr.md and .claude/rules/changelog.md for the
  backport and changelog-placement conventions.
• Human review: I have reviewed, tested, and verified the AI-generated
  content before submitting.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.