chore: quality-tightening (oxfmt + oxlint + tsc + vitest + husky + actionlint) (#833)

* chore: quality-tightening (oxfmt + oxlint + tsc + vitest + husky + actionlint)

Standard rollout for unity-builder. Most of the work was porting 24
test files from jest 27 to vitest 4.

- prettier -> oxfmt
- eslint (with @typescript-eslint, github, jest, prettier, unicorn) ->
  oxlint with eslint-plugin-unicorn
- jest 27 + jest-circus + ts-jest + @types/jest + @jest/globals ->
  vitest 4 + vite 7 + @vitest/coverage-istanbul (jest config files
  removed)
- new: tsgo --noEmit (alongside tsc fallback)
- lefthook (and lefthook.yml) -> husky 9 with the standard
  scripts/ensure-husky.mjs self-heal pattern + lint-staged
- new: gitleaks, actionlint, shellcheck as mise-managed binaries
- TypeScript bumped target ES2020 -> ES2022 + lib ES2022 + DOM (for
  Error.cause and modern globals)

Test migration (24 files):
- Bulk-converted jest.* -> vi.*; jest.Mocked -> Mocked from vitest;
  jest.MockedFunction -> MockedFunction.
- Added vitest imports to all *.test.ts files (and __mocks__/*.ts)
  that didn't have them.
- src/index.ts: extracted runMain() as a named export and gated the
  module-level invocation behind NODE_ENV !== 'test'. The
  index-plugin-features test now calls runMain() directly instead of
  relying on jest's removed vi.isolateModules.
- index-plugin-features.test.ts: moved hoisted refs (mockPlugin,
  mockLoadOrchestratorPlugin) into vi.hoisted() so vi.mock factories
  can reference them. Replaced arrow constructor mock for ImageTag
  with regular function() {...} (vitest 4 disallows arrows as ctors).
  Replaced require('./model') / require('@actions/core') inside test
  bodies with top-level imports.
- model/orchestrator-plugin.test.ts: dropped jest's '{ virtual: true }'
  flag (vitest doesn't support it); replaced the
  'mock factory throws' pattern with 'createPlugin throws' so vitest
  doesn't wrap the error message at the assertion site.
- model/versioning.test.ts: stray jest.spyOn -> vi.spyOn; replaced
  mockImplementation() with no args (jest pattern) by
  mockResolvedValue('') / mockImplementation(() => undefined) where
  the source expects a string return.

Workflow shell-quoting cleanup (actionlint):
- All bare $GITHUB_STEP_SUMMARY / $GITHUB_OUTPUT / $GITHUB_ENV
  redirects quoted across 2 workflows (SC2086).
- s3://$AWS_STACK_NAME / s3://$BUCKET_NAME -> s3://"$AWS_STACK_NAME"
  / s3://"$BUCKET_NAME".
- 'for i in {1..N}; do ... done' loops where i isn't referenced in
  the body renamed to 'for _ in' (SC2034).
- 'grep ... | wc -l' -> 'grep -c ...' (SC2126).
- Multiple consecutive '>> $file' redirects in
  validate-community-plugins.yml summary block collapsed into a
  single block redirect (SC2129).
- 'cat $file | python3 -c "..."' -> 'python3 -c "..." < $file'
  (SC2002).
- http://${VAR}:port -> http://"${VAR}":port (SC2086).

tsgo: kept tsc --noEmit as the default 'typecheck' because
unity-builder publishes CommonJS for the GitHub Action consumer,
which conflicts with tsgo's bundler/node16 moduleResolution
requirement (per playbook trap #9). 'yarn typecheck:tsgo' is wired
up for when consumers move to ESM.

Caveats: 28 pre-existing oxlint warnings remain (mostly
typescript/no-explicit-any across the build-parameter shapes and
vitest/no-disabled-tests on 2 explicitly skipped scenarios). Per
playbook trap #22 the lint script drops --deny-warnings.

Verified locally: format clean, lint 0/28, typecheck clean,
test 340/342 (2 pre-existing skipped), actionlint clean across all
12 workflows.

* ci(unity-builder): fix Tests + Plugin Architecture Health on quality-tightening

Three issues surfaced in CI after the jest -> vitest port:

1. **Obsolete snapshot blocks Tests job.**
   src/model/__snapshots__/versioning.test.ts.snap had two entries
   for the same 'throws for invalid strategy' assertion: one in the
   vitest format ('Versioning > determineBuildVersion > ...') and one
   in the legacy jest format without the '>'. vitest correctly
   regenerates the new one and flags the old one as obsolete; CI
   runs without --update so 'Test Files 1 failed' even though all
   343 tests passed. Removed the obsolete entry.

2. **'Plugin Architecture Health' workflow still calls jest.**
   .github/workflows/validate-orchestrator.yml had two 'npx jest'
   steps (orchestrator-plugin unit tests + orchestrator-standalone
   tests). The unity-builder + orchestrator codebases are both on
   vitest now. Replaced both with 'yarn vitest run'.

3. **jest-fail-on-console + src/jest.setup.ts left over.**
   The earlier vitest port missed the jest-fail-on-console
   integration. yarn install in CI surfaced
   YN0002: doesn't provide @jest/globals (requested by
   jest-fail-on-console). Removed jest-fail-on-console + jest.setup.ts;
   added src/test/setup.ts with the equivalent vitest beforeEach
   spies (same as unity-test-runner).

---------

Co-authored-by: frostebite <jas.f.ukcmti@gmail.com>

src/model/plugin.test.ts

@@ -1,3 +1,5 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
 /**
  * Tests for the generic plugin loader (plugin.ts).
  *
@@ -6,15 +8,15 @@
  * orchestrator-specific type.
  */
 
-const mockWarning = jest.fn();
-const mockInfo = jest.fn();
-jest.mock('@actions/core', () => ({
+const mockWarning = vi.fn();
+const mockInfo = vi.fn();
+vi.mock('@actions/core', () => ({
   warning: mockWarning,
   info: mockInfo,
 }));
 
 beforeEach(() => {
-  jest.resetModules();
+  vi.resetModules();
   mockWarning.mockClear();
   mockInfo.mockClear();
 });
@@ -31,25 +33,24 @@ describe('plugin (default package not installed)', () => {
 
 describe('plugin (default package installed)', () => {
   const fakePlugin = {
-    initialize: jest.fn(),
-    canHandleBuild: jest.fn().mockReturnValue(false),
-    handleBuild: jest.fn().mockResolvedValue({ exitCode: 0 }),
-    beforeLocalBuild: jest.fn(),
-    afterLocalBuild: jest.fn(),
-    handlePostBuild: jest.fn(),
+    initialize: vi.fn(),
+    canHandleBuild: vi.fn().mockReturnValue(false),
+    handleBuild: vi.fn().mockResolvedValue({ exitCode: 0 }),
+    beforeLocalBuild: vi.fn(),
+    afterLocalBuild: vi.fn(),
+    handlePostBuild: vi.fn(),
   };
 
-  const mockCreatePlugin = jest.fn().mockReturnValue(fakePlugin);
+  const mockCreatePlugin = vi.fn().mockReturnValue(fakePlugin);
 
   function installDefaultPluginMock(overrides: Record<string, unknown> = {}) {
-    jest.doMock(
-      '@game-ci/orchestrator',
-      () => ({
-        createPlugin: mockCreatePlugin,
-        ...overrides,
-      }),
-      { virtual: true },
-    );
+    // The `@game-ci/orchestrator` module is intentionally optional and may not
+    // be installed. `vi.doMock` lets the dynamic import in the loader resolve
+    // through this factory before vite tries to load a real package.
+    vi.doMock('@game-ci/orchestrator', () => ({
+      createPlugin: mockCreatePlugin,
+      ...overrides,
+    }));
   }
 
   beforeEach(() => {
@@ -94,18 +95,20 @@ describe('plugin (default package installed)', () => {
     const plugin = await loadPlugin();
 
     expect(plugin).toBeUndefined();
-    expect(mockWarning).toHaveBeenCalledWith(expect.stringContaining('does not export createPlugin'));
+    expect(mockWarning).toHaveBeenCalledWith(
+      expect.stringContaining('does not export createPlugin'),
+    );
   });
 
   it('propagates non-MODULE_NOT_FOUND errors', async () => {
-    const importError = new Error('Syntax error in module');
-    jest.doMock(
-      '@game-ci/orchestrator',
-      () => {
-        throw importError;
+    // Throw lazily from `createPlugin` rather than from the mock factory
+    // itself: vitest 4 wraps factory-time errors with its own message, which
+    // masks the inner error at the assertion site.
+    installDefaultPluginMock({
+      createPlugin: () => {
+        throw new Error('Syntax error in module');
       },
-      { virtual: true },
-    );
+    });
     const { loadPlugin } = await import('./plugin');
 
     await expect(loadPlugin()).rejects.toThrow('Syntax error in module');