Resolve knip dependency findings and align @earendil-works versions

[wojtekn]

Related issues

• Related to npx knip cleanup (follow-up to Clean up unused and misplaced dependencies flagged by knip #4394, which deferred the phantom-dependency findings)

How AI was used in this PR

Claude Code ran npx knip, then traced every finding to its root cause: for each phantom ("unlisted") package it checked where the import actually resolves in the lockfile and which workspace owns it; for each "unused" dependency it verified with grep across src/e2e and git log whether the consumer still exists. Each conclusion was confirmed with npm run typecheck (all workspaces), npm run cli:build, the affected Vitest suites, and a re-run of knip.

I worked iteratively on multiple improvements like deduping pi packages, removing remaining unused packages, then I reviewed all changes before opening this PR.

Proposed Changes

Dev-tooling / manifest change only — no runtime or user-visible behavior changes. The goal is that each workspace's package.json accurately declares what it imports, and that a knip run is signal-only going forward.

• Declared ~22 phantom dependencies in the workspace that imports them, instead of relying on npm hoisting. This removes a real fragility: packages like typebox/chalk in apps/cli and @earendil-works/pi-agent-core/pi-ai in packages/common were only resolving because a sibling dependency happened to hoist them — a transitive version change could have broken resolution. Each is pinned to the version already in the lockfile, so npm install is a no-op dedup.
• Silenced knip's confirmed false positives (@sentry/react referenced only as a string in a Vite manualChunks, @wp-playground/cli spawned as a binary, @automattic/wp-babel-makepot invoked via npx in a Fastfile, and the promptfoo config path) via top-level ignoreDependencies/ignoreBinaries, and dropped now-redundant knip config lines.
• Removed genuinely-dead dependencies and their orphaned test mocks: hpagent (never imported since it was added), rehype-raw (its only consumer, the legacy WPCOM assistant, was removed in Studio Code Desktop: remove enableStudioCodeUi beta flag and legacy assistant #3683), and @types/shell-quote (redundant — shell-quote now ships its own types; the runtime package stays).
• Pruned stale dependabot.yml entries for packages that no package.json declares anymore (hpagent, compression, compressible, strip-ansi, ora, cross-port-killer, pm2, @rive-app/*), including an empty group.
• Unified all @earendil-works/pi-* pins at 0.82.1, the version pi-coding-agent@0.82.1 expects for its siblings. This collapses the duplicate 0.81.0/0.82.1 copies that were sitting in the lockfile.

Testing Instructions

• npm install — completes cleanly, no peer-dependency conflicts, lockfile shrinks (duplicate copies removed).
• npm run typecheck — passes across all workspaces, confirming no declared/removed/bumped dependency broke resolution.
• npm run cli:build — succeeds, confirming the newly-declared bare imports (typebox, chalk) still bundle.
• npx knip — no remaining unlisted, binary, unresolved, unused-dependency, or configuration-hint findings.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[wpmobilebot]

📊 Performance Test Results

Comparing 929b8ca vs trunk

app-size

Metric	trunk	929b8ca	Diff	Change
App Size (Mac)	1372.96 MB	1402.67 MB	+29.70 MB	🔴 2.2%

site-editor

Metric	trunk	929b8ca	Diff	Change
load	1062 ms	1051 ms	11 ms	⚪ 0.0%

site-startup

Metric	trunk	929b8ca	Diff	Change
siteCreation	6529 ms	7585 ms	+1056 ms	🔴 16.2%
siteStartup	2394 ms	2871 ms	+477 ms	🔴 19.9%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)