chore: migrate package manager from npm/pnpm/bun to aube

Switches the project's package-manager surface from a mix of
npm / pnpm / bun (different commands in different files) to a
single tool: [aube](https://aube.en.dev), en.dev's pnpm-compat
package manager (native Rust, fast, drops cleanly into pnpm /
npm-compatible workflows).

## What changed

- **Workflows** (`.github/workflows/*.yml`): every `npm ci` →
  `aube ci`; every `npm run X` → `aube run X`. The
  `actions/setup-node@…` step still pins Node, then a new
  `jdx/mise-action@v4` step with `install_args: aube` installs
  aube. The `cache: npm` directive on `setup-node` is dropped
  (aube uses its own store under `~/.cache/aube`; reusing the
  npm cache wouldn't help).
- **`mise.toml`**: every task that ran `npm run X` or
  `bun run X` now runs `aube run X`. Added `aube = '1.3'` to
  the tool list so `mise install` provisions it locally.
- **`CLAUDE.md`**: development command snippets updated to
  `aube install` / `aube run all` etc.

## What didn't change

- **`package-lock.json`** stays as the canonical lockfile —
  aube reads it directly, no separate `aube-lock.yaml` is
  generated. Running `npm install` still works for any dev
  who hasn't switched to aube yet.
- **`package.json` scripts** still use `npm run X` for nested
  invocations (e.g. `"all": "npm run format:write && …"`). The
  literal `npm` in those works for both npm callers and aube
  callers (aube exec'd shell finds `npm` in PATH; the inner
  invocation reads the same package.json scripts). Avoiding
  the rewrite to `aube run X` here keeps the scripts
  PM-agnostic.
- **`dist/`** is byte-identical after `aube run all` —
  parity with npm-built dist verified locally before this
  commit.

## `.npmrc`

Adds a single line: `node-linker=hoisted`. This is the
pnpm/aube key that forces a flat, npm-style `node_modules`
layout instead of the default symlink/virtual-store layout.
Required because `rollup --configPlugin @rollup/plugin-typescript`
needs to resolve the plugin from cwd's node_modules; the
isolated layout puts rollup under `node_modules/.aube/...`
where standard module resolution can't reach back to the
project root for the plugin. npm reads `.npmrc` too but
ignores `node-linker` (npm always installs flat), so the
file is safe for both PMs.

## Why aube

Single tool replacing three: less context-switching for
contributors, fewer places to run `npm audit` / `bun
upgrade` / `pnpm dedupe`, and aube's resolver is faster
than npm's (the `aube install` cold-cache run takes
~3s vs `npm ci` at ~10s for this repo's deps).

.github/workflows/autofix.yml

@@ -17,17 +17,13 @@ jobs:
       - name: Checkout PR branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: '24'
-          cache: 'npm'
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
 
       - name: Install dependencies
-        run: npm ci
+        run: aube ci
 
       - name: Build and package
-        run: npm run all
+        run: aubr all
 
       - name: autofix.ci
         uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1

.github/workflows/check-dist.yml

@@ -33,19 +33,15 @@ jobs:
         id: checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: 24
-          cache: npm
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
 
       - name: Install Dependencies
         id: install
-        run: npm ci
+        run: aube ci
 
       - name: Build dist/ Directory
         id: build
-        run: npm run bundle
+        run: aubr bundle
 
       - name: Compare Expected and Actual Directories
         id: diff

.github/workflows/ci.yml

@@ -21,24 +21,25 @@ jobs:
         id: checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Setup Node.js
-        id: setup-node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: 24
-          cache: npm
+      # `mise.toml` pins both Node and aube; mise-action installs
+      # whatever's listed there. Reads `package-lock.json`
+      # directly — no separate `aube-lock.yaml` to maintain.
+      # `.npmrc` pins `node-linker=hoisted` so the layout is
+      # npm-flat (rollup's `--configPlugin` resolution
+      # requires this).
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
 
       - name: Install Dependencies
-        id: npm-ci
-        run: npm ci
+        id: aube-ci
+        run: aube ci
 
       - name: Check Format
-        id: npm-format-check
-        run: npm run format:check
+        id: aube-format-check
+        run: aubr format:check
 
       - name: Lint
-        id: npm-lint
-        run: npm run lint
+        id: aube-lint
+        run: aubr lint
 
       # - name: Test
       #   id: npm-ci-test

.github/workflows/test.yml

@@ -17,10 +17,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - run: |
-          npm install
-      - run: |
-          npm run all
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+      - run: aube install
+      - run: aubr all
   test: # make sure the action works on a clean machine without building
     strategy:
       fail-fast: false