refactor: single parse/scan, shared CI setup, integration matrix, typecheck tests

[quver]

Summary

Cleanup from a project-wide /simplify review (reuse, simplification, efficiency, altitude), plus CI consolidation.

Code (src/)

• Each Package.resolved is parsed once (it was parsed up to 5×). getPackagesWithInfo is the only parser; toVersionMap() projects it for comparePackages. getPackages is removed, and detectDevPackages now takes the resolved identity set instead of a file path (same as buildDependencyGraph).
• The project tree is walked once (it was walked 4× with the HTML report on). The new scanProject() collects Package.swift manifests and project.pbxproj classifications in one pass, and both detectDevPackages and buildDependencyGraph use its result. main.ts runs the scan lazily and at most once, so it is skipped entirely when only the SBOM is requested and development_packages is given.
• readTextOrNull() replaces five copies of the read-or-skip try/catch.
• __PACKAGE_VERSION__ is now set by vitest's define in tests, mirroring esbuild's --define, so the runtime package.json fallback that only existed for tests is gone.
• Minor simplifications: a redundant scheme check, has() + get()!, a redundant Set.add guard, and ?? undefined.

Config

• tsconfig.json now typechecks tests/ and vitest.config.ts. They were not checked before; the only error that turned up was a missing Dirent import.
• Removed settings that restate defaults: vitest clearMocks (default since vitest 5) and ESLint rules already covered by typescript-eslint recommended. I diffed eslint --print-config before and after, and the effective rules are identical. eslint.config.js now uses defineConfig from eslint/config.

CI

• New .github/actions/setup composite action (setup-node + npm ci), used by test, lint, release and the build action. This also fixes the build action pinning setup-node v6.2.0 while the workflows used v7.0.0.
• integration and integration-workspace are now a single matrix job. It reports integration (project) and integration (workspace).

⚠️ Branch protection: main currently requires test, build, integration and lint. The integration check no longer exists after this change, so the required checks will be updated to integration (project) and integration (workspace) once this PR's CI reports them. The workspace variant was not required before; it will be now.

Intentionally not changed

• Cleanup of the temp dir and snapshot stays in both main and post. Removing it from main would delay freeing disk space until the end of the job.
• Parsing done with flat regexes (packageRefs, the plugins: list, brace counting in pbxproj) is a correctness topic for a separate /code-review.
• withTimeout gives up waiting after 15s but does not kill the git ls-remote process. Switching to execFile with a timeout needs its own verification on a real runner.

Test plan

• npm run lint: effective ESLint rules unchanged
• npm run typecheck: now includes tests/
• npm test: 172 tests pass (3 new: single parse, single scan, no scan for SBOM with an explicit dev list), 100% coverage
• npm run build
• actionlint: no findings in the changed workflows or actions
• CI green, including both integration matrix variants
• Branch protection updated to the new check names

🤖 Generated with Claude Code

https://claude.ai/code/session_01KSejUgQivg9155whMyU9i5

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.73%. Comparing base (94fbc80) to head (1653153).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #91      +/-   ##
==========================================
- Coverage   99.75%   99.73%   -0.03%     
==========================================
  Files           3        3              
  Lines         408      377      -31     
  Branches      102       98       -4     
==========================================
- Hits          407      376      -31     
  Partials        1        1              

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.