feat(deps): upgrade upstream dependencies

- rolldown: ac5c710 -> v1.0.1 (2777945)
- vite: 66f3194 -> v8.0.13 (a46f11a)
- vitest: 4.1.5 -> 4.1.6
- oxfmt: 0.48.0 -> 0.49.0
- oxlint: 1.63.0 -> 1.64.0
- oxc (Rust): 0.128.0 -> 0.130.0
- @oxc-project/runtime: 0.129.0 -> 0.130.0
- @oxc-project/types: 0.129.0 -> 0.130.0
- oxc-minify: 0.129.0 -> 0.130.0
- oxc-parser: 0.129.0 -> 0.130.0
- oxc-transform: 0.129.0 -> 0.130.0
- @vitejs/devtools: 0.1.21 -> 0.1.23

Code changes:
- packages/core/build.ts: update rolldown pluginutils source path to read from `packages/rolldown/node_modules/@rolldown/pluginutils`.
- packages/tools/src/sync-remote-deps.ts: support `.mjs` / `.d.mts` exports when transforming pluginutils, and update the pluginutils package.json lookup path to match the new nested location.
- packages/core/package.json: switch `./rolldown/pluginutils` and `./rolldown/pluginutils/filter` exports to `.mjs` / `.d.mts`; bump bundled `vite`/`rolldown` versions.
- pnpm-workspace.yaml: add `@rolldown/pluginutils` catalog entry and drop its workspace override; bump `rolldown-plugin-dts` (^0.23 -> ^0.25), `valibot` (1.3.1 -> 1.4.0), `vitepress-plugin-graphviz` (^0.0.1 -> ^0.1.0); update `vitest-dev` override to `^4.1.6`.
- Cargo.toml: pin `mimalloc-safe = "=0.1.58"`.
- rust-toolchain.toml: bump nightly channel to `nightly-2026-03-15`.
- packages/cli/snap-tests-global/command-staged-broken-config/snap.txt: refresh snapshot for the new oxc parser error formatting (`Error: Unexpected token` -> `Unexpected token`).
- packages/tools/.upstream-versions.json, Cargo.lock, pnpm-lock.yaml: regenerated to match the new versions.

Author: voidzero-guard[bot]