Switches the project's package-manager surface from a mix of
npm / pnpm / bun (different commands in different files) to a
single tool: [aube](https://aube.en.dev), en.dev's pnpm-compat
package manager (native Rust, fast, drops cleanly into pnpm /
npm-compatible workflows).
## What changed
- **Workflows** (`.github/workflows/*.yml`): every `npm ci` →
`aube ci`; every `npm run X` → `aube run X`. The
`actions/setup-node@…` step still pins Node, then a new
`jdx/mise-action@v4` step with `install_args: aube` installs
aube. The `cache: npm` directive on `setup-node` is dropped
(aube uses its own store under `~/.cache/aube`; reusing the
npm cache wouldn't help).
- **`mise.toml`**: every task that ran `npm run X` or
`bun run X` now runs `aube run X`. Added `aube = '1.3'` to
the tool list so `mise install` provisions it locally.
- **`CLAUDE.md`**: development command snippets updated to
`aube install` / `aube run all` etc.
## What didn't change
- **`package-lock.json`** stays as the canonical lockfile —
aube reads it directly, no separate `aube-lock.yaml` is
generated. Running `npm install` still works for any dev
who hasn't switched to aube yet.
- **`package.json` scripts** still use `npm run X` for nested
invocations (e.g. `"all": "npm run format:write && …"`). The
literal `npm` in those works for both npm callers and aube
callers (aube exec'd shell finds `npm` in PATH; the inner
invocation reads the same package.json scripts). Avoiding
the rewrite to `aube run X` here keeps the scripts
PM-agnostic.
- **`dist/`** is byte-identical after `aube run all` —
parity with npm-built dist verified locally before this
commit.
## `.npmrc`
Adds a single line: `node-linker=hoisted`. This is the
pnpm/aube key that forces a flat, npm-style `node_modules`
layout instead of the default symlink/virtual-store layout.
Required because `rollup --configPlugin @rollup/plugin-typescript`
needs to resolve the plugin from cwd's node_modules; the
isolated layout puts rollup under `node_modules/.aube/...`
where standard module resolution can't reach back to the
project root for the plugin. npm reads `.npmrc` too but
ignores `node-linker` (npm always installs flat), so the
file is safe for both PMs.
## Why aube
Single tool replacing three: less context-switching for
contributors, fewer places to run `npm audit` / `bun
upgrade` / `pnpm dedupe`, and aube's resolver is faster
than npm's (the `aube install` cold-cache run takes
~3s vs `npm ci` at ~10s for this repo's deps).
