ci: add test reporting coverage summary

[jasonsaayman]

Summary

• Add the Vite/Vitest/Oxlint tooling changes present on this branch.
• Add a CI-only Vitest reporting script that emits JUnit results and coverage summary data.
• Publish test results with dorny/test-reporter@v3 in the pull request workflow.
• Add coverage results to the GitHub Actions job summary and archive the completed OpenSpec change.

Verification

• pnpm run lint
• pnpm run typecheck
• pnpm test
• pnpm run test:ci
• pnpm run build

Notes

• This is repository CI reporting only and does not change the bundle-size action runtime API.
• The test reporter is skipped for fork PRs/read-only-token contexts by requiring the PR head repo to match this repository.

---

Summary by cubic

Adds CI test reporting for Vitest and a coverage summary in PR checks, and migrates repo tooling to Vite/Vitest/Oxlint without changing the action’s runtime or API.

• New Features

  • PR workflow runs lint, typecheck, and Vitest with coverage.
  • Publishes JUnit results via dorny/test-reporter@v3 when the PR head repo matches this repo; skips on forks/read-only tokens.
  • Adds a coverage summary to the job summary; artifacts at reports/vitest-junit.xml and coverage/coverage-summary.json with checks: write permission.

• Refactors

  • Build uses vite to bundle src/index.ts to dist/index.js (CommonJS); tests run on vitest; lint uses oxlint.
  • Adds @/* alias and bundler-style TS config; updates scripts: lint, typecheck, test, test:ci, build.
  • Removes @vercel/ncc, intermediate lib/, and dist/licenses.txt; runtime behavior and action API unchanged.

^{Written for commit 7b8af4b. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

2 issues found across 51 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="THREAT_MODEL.md">

<violation number="1" location="THREAT_MODEL.md:75">
P2: This bullet overstates workflow hardening: at least one third-party action (`dorny/test-reporter@v3`) is not pinned by commit SHA.</violation>
</file>

<file name="src/index.ts">

<violation number="1" location="src/index.ts:16">
P2: The `endsWith("dist/index.js")` fallback can trigger `run()` for unrelated entry scripts, causing unintended side effects when this module is imported in processes whose argv script path matches that suffix.</violation>
</file>

_{Note: This PR contains a large number of files. Free-tier reviews are limited to 40 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review. Paid plans can review more files.
You're on the cubic free plan with 10 free PR reviews remaining this month. Upgrade for unlimited reviews.
Re-trigger cubic}

[github-actions]

Bundle Size Report

File	Baseline gzip	Current gzip	Difference	Status
index.js	302 B	43 B	-259 B (-85.76%)	🟢
Total	302 B	43 B	-259 B (-85.76%)	🟢