QVAC-18679 feat[api]: wire qvac verify bundle into Expo plugin

[opaninakuffo]

🚧 Draft until: #1969 (qvac verify deps) and #1984 (qvac verify bundle) merges and @qvac/cli@0.4.0 ships to the registry.

🎯 What problem does this PR solve?

• QVAC-18678 feat[api]: add qvac verify bundle command for prebuild and ABI verification #1984 shipped qvac verify bundle as a standalone CLI; without auto-wiring, Expo consumers can still ship a worker.mobile.bundle.js missing prebuilds or with an ABI-incompatible engines.bare.
• The previous Expo plugin silently fell back to npx --package=@qvac/cli qvac when the CLI was missing — risking a different CLI version than the consumer pinned.

📝 How does it solve it?

• Drop the npx fallback — resolveCliCommand throws CliNotFoundInNodeModulesError (50608) when node_modules/@qvac/cli/dist/index.js is missing. Consumers must declare @qvac/cli as a dep.
• Reorder the build flow to runBundler → assert bundle exists → runVerifier → fs.copyFileSync. The SDK dist/worker.mobile.bundle.js only updates when verification passes; failure preserves the last known-good artifact and fails Expo prebuild fast.
• runVerifier invokes qvac verify bundle --addons-source <bundle> --host <h>... for every MOBILE_HOSTS entry. Non-zero exit → BundleVerificationFailedError (50609).
• Runtime sourcing via qvac.config.* — the plugin already discovers qvac.config.{json,js,mjs} for bundle sdk and now forwards the same path as --config <path> to verify bundle (PR 2 capability). With config, ABI checks are pinned to bareRuntimeVersion. Without config, the CLI auto-detects from node_modules (bare-runtime → bare); ABI checks stay strict on auto-detect, and only fall through to unknown-runtime-version (warning) when neither is installed. Prebuild-presence checks always run.

Pear deferral: pear/pre.ts carries a head-note that qvac verify bundle isn't wired there yet — Pear consumers should run it manually (locally and/or in CI) before pear stage / pear run.

🔌 API Changes

• New error codes (Build/Bundle range):
  • CLI_NOT_FOUND_IN_NODE_MODULES (50608) → CliNotFoundInNodeModulesError
  • BUNDLE_VERIFICATION_FAILED (50609) → BundleVerificationFailedError
• Behavior change: withMobileBundle throws CliNotFoundInNodeModulesError instead of silently using npx. Consumers must add @qvac/cli (≥0.3.0) to their (dev)dependencies.
• Config field consumed: optional bareRuntimeVersion: string in qvac.config.{json,js,mjs,ts} (read by the CLI via --config; no new SDK API).

🧪 How was it tested?

• Unit (test/unit/with-mobile-bundle.test.ts, 9 tests):
  • MOBILE_HOSTS matches the canonical mobile host set.
  • buildVerifyBundleCommand: emits one --host per host; omits --config (and asserts no stray --bare-runtime-version — regression guard for the removed env-var path); includes --config "<path>" when provided; quotes config paths with spaces; quotes the bundle path; invokes the verify bundle subcommand.
  • resolveCliCommand: returns node "<absPath>" against a real mkdtemp fs fixture; throws CliNotFoundInNodeModulesError when the CLI is absent.
• Lint + typecheck + full test:unit: green; no regressions.

Manual smoke — qvac-app-workbench-mobile

Locally packed cli and sdk packages, installed as file: deps, then npm run prebuild:android (4 MOBILE_HOSTS, 33 addons, bare-runtime@1.26.0 in node_modules):

#	qvac.config.json	Result	Evidence
1	absent	✅ exit 0	"no qvac.config.* found" warning; CLI auto-detected bare-runtime@1.26.0; 33 addons verified; dist copied
2	bareRuntimeVersion: "1.26.0"	✅ exit 0	"Found qvac.config.json"; no warning; 33 addons verified; dist copied
3	bareRuntimeVersion: "0.0.1"	✅ exit 1 as intended	24 ABI mismatches; BundleVerificationFailedError (50609); dist NOT updated (last known-good preserved)

Scenario 3's stack confirmed runVerifier forwards --config:

node "<…>/@qvac/cli/dist/index.js" verify bundle \
  --addons-source "<…>/qvac/worker.bundle.js" \
  --host android-arm64 --host ios-arm64 \
  --host ios-arm64-simulator --host ios-x64-simulator \
  --config "<…>/qvac.config.json"

Manual smoke — Pear head-note workflow

Validated:

• Packed sdk ships the new head-note in pear/pre.js.
• Manual command from the head-note (qvac verify bundle --addons-source <bundle> --host darwin-arm64 --config qvac.config.json) works end-to-end: invalid runtime → 24 ABI errors / exit 1; valid runtime → 33 addons verified / exit 0.