chore(test): wire vitest, fleet alignment + dep cleanup

Phase B (test wiring) + Phase D (light dep cleanup).

Test:
- Add test/smoke.test.mts placeholder (vitest exits 1 when no tests
  found and the fleet scripts/test.mts doesn't pass --passWithNoTests
  for all-mode runs).
- Add vitest.config.mts at root re-exporting .config/vitest.config.mts.
  Fleet keeps configs in .config/ but vitest auto-discovers from cwd.
- Migrate poolOptions.threads.* to top-level maxWorkers/minWorkers
  (vitest 4 deprecation).
- Scope vitest discovery to repo's own test/ via dir + exclude
  .claude/** (skips hook node:test suites).

Dep cleanup:
- Drop @socketsecurity/config (unused).
- Drop @types/micromatch (unused).
- Switch @socketsecurity/lib + @types/node to catalog: references.

Known dead code surfaced by tsgo noUnusedLocals (kept disabled
pending focused removal pass): src/auth.ts(293), executable.ts(60),
interpreter.ts(301), import-finder.ts(5), decorations.ts(30,31,300),
parse-externals.ts(17,500), languages.ts(1), util.ts(136).

Verified: check + test --all + build all green.

Author: jdalton

.config/vitest.config.mts

@@ -16,18 +16,26 @@ export default defineConfig({
     },
     globals: false,
     environment: 'node',
+    // Disable workspace-project discovery — pnpm-workspace.yaml lists
+    // .claude/hooks/* as workspace packages so they get treated as
+    // their own vitest projects, but those tests use node:test and
+    // are run by the hooks themselves, not by this repo's vitest.
+    projects: [{ test: { include: ['test/**/*.test.{js,ts,mjs,mts,cjs}'] } }],
     include: ['test/**/*.test.{js,ts,mjs,mts,cjs}'],
+    exclude: [
+      '**/node_modules/**',
+      '**/dist/**',
+      '**/out/**',
+      '**/.cache/**',
+      '**/.claude/**',
+    ],
     reporters: ['default'],
+    // Vitest 4 moved poolOptions.threads.* to top-level. Keeping
+    // single-threaded under coverage for deterministic v8 instrumentation.
     pool: 'threads',
-    poolOptions: {
-      threads: {
-        singleThread: isCoverageEnabled,
-        maxThreads: isCoverageEnabled ? 1 : 16,
-        minThreads: isCoverageEnabled ? 1 : 2,
-        isolate: false,
-        useAtomics: true,
-      },
-    },
+    isolate: false,
+    maxWorkers: isCoverageEnabled ? 1 : 16,
+    minWorkers: isCoverageEnabled ? 1 : 2,
     testTimeout: 10_000,
     hookTimeout: 10_000,
     bail: process.env.CI ? 1 : 0,

package.json

@@ -117,7 +117,6 @@
     "@babel/parser": "7.29.3",
     "@babel/traverse": "7.29.0",
     "@babel/types": "7.29.0",
-    "@socketsecurity/config": "3.0.1",
     "@socketsecurity/lib": "catalog:",
     "@vscode/python-extension": "1.0.6",
     "ini": "6.0.0",
@@ -128,8 +127,7 @@
     "@types/babel__traverse": "7.28.0",
     "@types/ini": "4.1.1",
     "@types/json-to-ast": "2.1.4",
-    "@types/micromatch": "4.0.10",
-    "@types/node": "24.9.2",
+    "@types/node": "catalog:",
     "@types/vscode": "1.118.0",
     "@typescript/native-preview": "7.0.0-dev.20260415.1",
     "@vitest/coverage-v8": "4.1.5",

pnpm-lock.yaml

@@ -0,0 +1,13 @@
+/**
+ * @fileoverview Smoke test — placeholder to keep the vitest suite
+ * non-empty until the source has its own coverage. Drop this file
+ * once `src/` has tests.
+ */
+
+import { describe, expect, test } from 'vitest'
+
+describe('smoke', () => {
+  test('vitest is wired up', () => {
+    expect(1 + 1).toBe(2)
+  })
+})

test/smoke.test.mts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Vitest config root anchor — re-exports the canonical
+ * config under `.config/`. The fleet pattern places configs under
+ * `.config/`, but vitest's CLI auto-discovers from the cwd; passing
+ * `--config .config/vitest.config.mts` requires editing the
+ * fleet-canonical `scripts/test.mts` which is tracked byte-identical
+ * across the fleet. A root re-export is the cheapest fleet-safe fix.
+ */
+export { default } from './.config/vitest.config.mts'