build: restore strict node_modules, fixing six phantom deps

[lukecotter]

📝 PR Overview

Stacked on #1070 — base is build-pnpm-12, so review that one first and this diff stays to three commits.

shamefullyHoist: true flattened all 1241 transitive packages into the root node_modules. Only 76 are declared across the four manifests, so roughly 1200 undeclared packages were importable from any file in the repo, including across the lana to log-viewer boundary that AGENTS.md makes a hard rule. Strict node_modules is the mechanism that enforces that rule, and it was switched off.

Dropping the setting leaves 29 entries in the root and turns six long-standing phantom dependencies into build failures. All six are declared here. pnpm build, pnpm build:fast, pnpm lint, pnpm test, the docs site and the vsix all pass, and the vsix is unchanged at 26 files / 1021.42 KB.

🛠️ Changes made

• @jest/globals and tslib were declared by no package. @jest/globals is imported by 175 test files across all three projects; tslib is required by importHelpers: true in both lana and log-viewer. Both resolved only through the hoisted root.
• sass and lightningcss are imported by scripts/rollup-plugin-css.mjs, and @vscode/codicons by rollup.config.mjs and rolldown.config.ts — all root-level build files, but declared only by log-viewer. Added to the root devDependencies.
• @types/node is required by scripts/tsconfig.json ("types": ["node"]) and was declared only by lana. Added to the root.
• scripts/rollup-plugin-css.mjs derives sass loadPaths from the importing stylesheet upwards to the repo root, the way Node resolves a module, instead of naming a single root node_modules. DataGrid.scss loads tabulator-tables, which belongs to log-viewer. The old comment in pnpm-workspace.yaml blamed the rollup commonjs and node-resolve plugins; sass was the real dependency.
• Four overrides removed: @xmldom/xmldom@<0.8.12, fast-uri@<=3.1.0, lodash@>=4.0.0 <=4.17.23 and undici@>=7.17.0 <7.24.0. Each is a subset of an entry that stays, with the same or a stronger replacement, so nothing resolves differently. serialize-javascript@<=7.0.2 was deliberately kept: it covers versions below 5.0.0, which serialize-javascript@>=5.0.0 <7.0.5 does not.

🧩 Type of change (check all applicable)

• 🐛 Bug fix - something not working as expected
• ✨ New feature – adds new functionality
• ♻️ Refactor - internal changes with no user impact
• ⚡ Performance Improvement
• 📝 Documentation - README or documentation site changes
• 🔧 Chore - dev tooling, CI, config
• 💥 Breaking change

No user-visible change and no product code touched. The six undeclared dependencies were latent defects rather than live failures — hoisting masked them — so this is filed as a chore.

📷 Screenshots / gifs / video [optional]

None — no UI change.

🔗 Related Issues

None.

✅ Tests added?

• 👍 yes
• 🙅 no, not needed
• 🙋 no, I need help

No product code changed. The acceptance test is that a clean checkout builds and packages identically under strict linking.

Verification must not be run from a nested worktree. A checkout inside another checkout resolves upward into the parent's hoisted node_modules, so every command passes while CI would fail. These results come from a checkout extracted outside any repo tree, installed with --frozen-lockfile:

• pnpm install — 29 entries in the root node_modules, down from 1241.
• pnpm build (rollup) and pnpm build:fast (rolldown) — both succeed; they share the CSS plugin.
• pnpm lint — 0 errors, 12 pre-existing no-console warnings.
• pnpm test — 188 suites, 2617 tests pass across the three projects.
• pnpm --filter lana run build:vsix — 26 files, 1021.42 KB, matching the pre-change baseline.
• pnpm --filter docs-site run build — succeeds.

Each of the three commits regenerates pnpm-lock.yaml for its own concern, so each is independently consistent.

📚 Docs updated?

• 🔖 README.md
• 🔖 CHANGELOG.md
• 📖 help site
• 🧪 Marked any pre-release-only features (README 🧪 badge — see RELEASING.md)
• 🙅 not needed

Build tooling is invisible to extension users. No shamefullyHoist reference survives anywhere in the repo, so no doc went stale.

Anything else we need to know? [optional]

A new undeclared import now fails the build instead of silently working. That is the point of the change, but it is a behaviour change for contributors: adding an import without declaring the package in that workspace's package.json will no longer resolve.

A stale-output issue I hit is already fixed on main. Before merging main in, build:dev cleaned only lana/out, so running build:fast then build left rolldown chunks behind for rollup-plugin-copy to carry into the vsix — a 32-file, 1.04 MB package instead of 26. #1039 resolves it from both directions: rolldown wipes its own output directory, and build:dev:rollup and watch:rollup now clean log-viewer/out explicitly. Verified by planting a stale chunk and rebuilding. No follow-up needed.

Also spotted, not fixed: ws@7.5.13 resolves in the tree but sits below the ws@>=8.0.0 <8.20.1 override floor, so that override does not cover it.