Use node:process instead of the process global, enforced by a Taskless rule #347

What

packages/cli/src reaches for the process global everywhere: 25 files use process.env, process.exitCode, process.cwd(), process.stdout, and 0 files import node:process. Noticed on #345 (ci: process.env.CI in agent.ts and onboard.ts), which follows the existing convention and should not carry the fix.

Why it matters

• An explicit import process from "node:process" makes the Node dependency visible in the module graph. prompts.js has a build-time "no host capabilities" check that reads rollup's resolved imports; a global reach is invisible to it, an import is not.
• It is the convention the rest of our node: imports already follow (node:path, node:fs, node:child_process).

How: a Taskless rule, not an ESLint rule

Use ourselves. Author an ast-grep rule under .taskless/rules/ that flags a process identifier reference in a module with no node:process import, with a fix that is not attempted (an import needs placement; the finding names the file and the sweep adds it). ESLint's n/prefer-global/process: ["error", "never"] is the reference behaviour, and the rule's tests should cover:

• process.env.X with no import → finding
• process.env.X with import process from "node:process" → clean
• a local const process = … or a parameter named process → clean (shadowed)
• globalThis.process → finding (or documented as out of scope)

Then the 25-file sweep in the same PR, so the rule lands green.

Scope note

packages/cli/src only to start; .github/scripts/*.cjs are CommonJS and out of scope for this rule.