feat(deps): upgrade upstream dependencies

[Brooooooklyn]

Summary

• Bump rolldown to v1.0.0-rc.16 and re-merge its Cargo workspace (oxc 0.123 → 0.126, jsonschema 0.45 → 0.46, new oxc_str/path-posix, dropped smallvec).
• Bump tsdown to 0.21.9 and update vp pack to forward config deps via the new configDeps: Set<string> signature.
• Bump oxlint-tsgolint to 0.21.1 and @vitejs/devtools to 0.1.14.
• Exempt import-without-cache and logs-sdk from minimumReleaseAge in pnpm-workspace.yaml.

Dependency updates

Package	From	To
rolldown	27cb729	v1.0.0-rc.16 (edec4fa)
tsdown	0.21.8	0.21.9
oxlint-tsgolint	0.21.0	0.21.1
@vitejs/devtools	0.1.13	0.1.14

Code changes

• Cargo.toml, Cargo.lock: re-merge rolldown workspace — bump oxc* crates 0.123.0 → 0.126.0, add oxc_str, bump jsonschema 0.45.0 → 0.46.0, add path-posix 0.0.1, remove unused smallvec.
• packages/cli/src/pack-bin.ts: replace configFiles: string[] with configDeps: Set<string> and pass it into resolveUserConfig / buildWithConfigs to match tsdown 0.21.9.
• packages/core/package.json: bump @vitejs/devtools, @tsdown/css, @tsdown/exe, and bundledVersions (rolldown, tsdown).
• pnpm-workspace.yaml: update oxlint-tsgolint and tsdown catalog entries, add import-without-cache and logs-sdk to minimumReleaseAgeExclude.
• packages/tools/.upstream-versions.json, pnpm-lock.yaml: regenerated lockfile / upstream pin updates.

Build status

• sync-remote-and-build: failure
• build-upstream: success

---

Note

Medium Risk
Primarily dependency upgrades (notably rolldown/oxc* and jsonschema) that can affect bundling/parsing behavior across the toolchain, plus a small CLI integration change for config dependency tracking.

Overview
Upgrades the Rust and Node dependency stack, including rolldown to 1.0.0-rc.16, oxc* crates 0.123.0 → 0.126.0 (adding oxc_str), and jsonschema 0.45.0 → 0.46.0, with corresponding lockfile updates and new transitive deps like path-posix.

Updates the vp pack CLI to track config file dependencies via a configDeps: Set<string> and pass them through resolveUserConfig/buildWithConfigs, aligning with the tsdown 0.21.9 update. Also bumps related JS tooling (@vitejs/devtools 0.1.14, oxlint-tsgolint 0.21.1) and adjusts pnpm-workspace.yaml to exclude import-without-cache and logs-sdk from minimumReleaseAge enforcement.

^{Reviewed by Cursor Bugbot for commit b50f70f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	7a414a5
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/69e1d1f31d103500082d5bd3