v2.83.0: line-move-tolerant runtime-coverage baselines, Nuxt auto-imports, more framework plugins

Runtime coverage

• Cross-surface function identity. Runtime coverage now adopts the fallow-cov-protocol v2 FunctionIdentity (a fallow:fn:<hash> join key over file, name, and start line). One value identifies a function across findings, hot paths, blast-radius, and importance entries, and across V8 / Istanbul / oxc producers (columns are excluded from the hash). Old artifacts without an identity keep working via the existing path/name/line fallback. (Closes #506)
• Baselines survive line moves. Function identities can now carry a source_hash: a content digest of the function body that excludes position. Runtime-coverage baselines match on it in addition to stable_id and the legacy id, so a function that moves to a different line but is otherwise unedited stays suppressed; editing the body re-surfaces it for review. (Closes #742)

Framework support

• Nuxt components referenced only by template tag are now tracked. A new auto_imports plugin capability synthesizes a real graph edge from <MyComponent />-style tags to their component files (directory-prefixed PascalCase, <Lazy...>, .client/.server/.global). Additive by default; opt into autoImports: true to report genuinely-unreferenced convention components as unused. Thanks @Hal-Spidernight for the detailed proposal. (Closes #704)
• New built-in plugins: Contentlayer, Obsidian, WXT, Varlock, OpenNext Cloudflare, and browser-extension (WebExtension / Chrome MV2+MV3 manifests) projects no longer report their config files, entrypoints, and manifest-declared runtime files as unused.

Fixes

• ignoreUnresolvedImports config field accepts import-specifier globs to suppress expected unresolved-import findings. Thanks @OmerGronich. (Closes #726)
• tsdown .mts / .cts config files are treated as entry points. Thanks @eojoel. (Closes #744)
• fallow audit no longer emits spurious Nuxt/Astro prerequisite warnings on its base pass (#705).
• Workspace packages without an exports map resolve missing prebuild output back to source. (Closes #725)
• File health scores surface high CRAP-risk files even when their Maintainability Index is not the lowest. (Closes #554)
• POSIX-rooted paths from Linux tooling stay absolute on Windows. (Closes #614)
• GitHub Action: artifacts-dir writes generated files outside the repository root. Thanks @Guria. (Closes #735)

Notes

stable_id values use the reconciled cross-producer recipe shared by the CLI, the fallow-cov sidecar, and cloud aggregation. Runtime-coverage baselines written on a previous version re-baseline once.

Full Changelog: v2.82.0...v2.83.0