feat(js_runtime): add multi-source Node version reading - #522

Bumps the `vite-task` git dependency from `cb580c2` to `4003f65`.

## Changes

The delta is entirely internal `fspy` (file-access tracking)
shared-memory work — no user-facing CLI flags, config fields, or
behavior changes, so no docs updates were needed.

- **fix(fspy):** use `memfd` for Linux shared memory — automatic
file-access tracking on Linux now works in containers and Kubernetes
runners with limited `/dev/shm` space
([#523](voidzero-dev/vite-task#523),
[#353](voidzero-dev/vite-task#353))
- **perf(fspy):** use sparse Windows shared memory — Windows file-access
tracking now uses sparse temporary backing files where supported,
avoiding upfront allocation of the full backing file on disk
([#524](voidzero-dev/vite-task#524))
- **refactor(fspy):** own macOS shared-memory mapping
([#526](voidzero-dev/vite-task#526))
- **docs/test(fspy):** document shared-memory facade ownership semantics
([#521](voidzero-dev/vite-task#521)); reproduce
constrained dev shm failure
([#522](voidzero-dev/vite-task#522))

The lockfile change reflects this refactor: `fspy` now pulls in `memfd`
and drops `shared_memory`.

## Validation

- `cargo check --workspace` passes — the new `vite-task` compiles
cleanly, confirming no breaking changes on the consuming side (including
`vite_cli_snapshots`, which compiles against vite-task's PTY/snapshot
test crates).
- vite-plus crate tests pass. (One pre-existing, environment-specific
stack overflow in `vite_global_cli`'s
`unknown_argument_detected_with_pass_as_value_hint` clap-parsing test
reproduces identically on `main` and is unrelated to this bump.)
- PTY snapshot output is unchanged by the bump; the remaining local
snapshot diffs in this sandbox are all environmental (no built
`packages/cli/dist`, plus registry TLS/network restrictions), left to
CI, which builds the JS CLI and has registry access.

## Changelog

Full vite-task CHANGELOG diff:
``https://github.com/voidzero-dev/vite-task/compare/cb580c214bb2314fc1f633a3812782c9b3a1d956...4003f65a3e5e3d957ff81b157e85e6ee41cc59fc#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4ed``

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---
_Generated by [Claude
Code](https://claude.ai/code/session_01YERo1yECf81w37US2Gqnow)_

Co-authored-by: Claude <noreply@anthropic.com>

<!-- claude-projects-attribution: {"github_login":"Brooooooklyn"} -->
_Requested by **Brooklyn** · [project
thread](https://claude.ai/code/project/chan_018s9RxRdtH424j2EhXdzV3N?thread=cmsg_018s9RxRdtH424j2EhXdzV3NQxbeR8Pt7qaqSQwoq9rEFo)_

<!-- routine:prune-tests:duplicate-dev-engines-parse-tests -->

Before: three tests in `vp_shared::package_json` each repeated one case
of a stronger table-style test in the same module, with the same
assertions, so they could only fail together with it.

After: the three tests are gone. Every product mutation that failed one
of them also fails its covering test, before and after the removal. Only
`#[cfg(test)] mod tests` changes.

### Totals

- Files touched: 1.
- Cases deleted: **3 of 135** `vp_shared` unit cases (plus 6 doctests,
unchanged); after: 132. The workspace-wide count could not be collected
(see below).
- Cases merged: 0.
- Net lines: **−33** (+0 / −33).
- Runtime saved: about 0 ms (each deleted case reports `<0.000s>`).

### Removals

1. **`test_malformed_single_entry_parses_as_absent`**: its input
`"runtime": "node@24"` and assertion `runtime.is_none()` are the
`"\"node@24\""` row of `test_parse_field_non_object_values`. M1 (accept
a bare string as a single entry's name) failed both; after the removal
it still fails `test_parse_field_non_object_values`.
2. **`test_malformed_dev_engines_does_not_break_engines_parse`**: a
string `devEngines` next to `engines.node`, with three assertions;
`test_parse_dev_engines_non_object_values` makes the same three for its
`"\"text\""` row (and seven more shapes). M2 (reject a string
`devEngines`) failed both; after, it still fails the covering test.
3. **`test_parse_engines_node`**: `{"engines":{"node":">=20.0.0"}}` with
one assertion, the `engines` half of
`test_parse_both_engines_and_dev_engines` (`engines` and `devEngines`
are independent serde fields). M3 (`#[serde(default, rename =
"engine")]` on `engines`) failed it and 4 others; after, it still fails
`test_parse_both_engines_and_dev_engines`,
`test_parse_dev_engines_non_object_values` and
`test_parse_engines_node_empty`.

Kept after defense: none; every nominee had another test failing on its
mutation.

### Case counts

| file | before | after | delta |
|---|---|---|---|
| `crates/vp_shared/src/package_json.rs` | 27 | 24 | −3 |
| `vp_shared` unit total | 135 | 132 | −3 |

0 failures before and after.

### What ran and what did not

- Ran at `4928bc57` and on this branch: `cargo test -p vp_shared -- -Z
unstable-options --report-time`; the three mutations (each reverted);
`cargo clippy -p vp_shared --all-targets --all-features -- --deny
warnings`; `cargo fmt --all -- --check`; `git diff --check`. All clean.
- To build without `just init` (which clones rolldown),
`packages/cli/binding` was dropped from the workspace members locally;
`Cargo.toml` and `Cargo.lock` were restored and are not in this PR.
- Not run: `just check` / `just test` / `just lint` (they need the
rolldown clone), other crates, Windows, the JS suite and the snapshot
suites. No other file changes.

Open pull requests: none of the 62 open PRs touches this file. Ages:
`test_parse_engines_node` from #522 (2026-02-07), the other two from
#1760 (2026-06-08); none was added for a bug or sits in a permission or
security suite.

To revert: `git revert 261d71b`.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01PxVsmvB9xfZKfVnUonY8kf)_

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: MK (fengmk2) <fengmk2@gmail.com>

…ble (#3355)

<!-- claude-projects-attribution: {"github_login":"Brooooooklyn"} -->
_Requested by **Brooklyn** · [project
thread](https://claude.ai/code/project/chan_018s9RxRdtH424j2EhXdzV3N?thread=cmsg_018s9RxRdtH424j2EhXdzV3NQxbeR8Pt7qaqSQwoq9rEFo)_

<!-- routine:prune-tests:node-version-table -->

Before: nine `test_parse_node_version_content_*` tests in
`crates/vp_js_runtime/src/dev_engines.rs` each asserted a few input →
output pairs for the pure function `parse_node_version_content`, one
`#[test]` per group.

After: one table-driven `test_parse_node_version_content` holds all 25
rows, its section comments and the "LTS Alias Tests" banner. Each
assertion names the input that failed. Nothing is deleted. Only the test
module changes.

How: each row group was defended by mutating
`parse_node_version_content` and reverting. Two mutations failed only
one of the old tests, so those rows are kept and the new test carries a
comment saying so.

### Totals

- Files touched: 1 (test module only).
- Cases deleted: 0. Cases folded: 9 into 1, so `vp_js_runtime --lib`
goes from 137 to 129.
- Net lines: **−15** (+51 / −66).
- Runtime saved: about 0 (each old case reported `<0.000s`).

### Mutations (each reverted)

| Change | Failed before | Failed after |
|---|---|---|
| drop `strip_prefix('v')` | 3 of the nine, plus 3 `.nvmrc` tests | the
folded test, plus the 3 `.nvmrc` tests |
| drop `.trim()` | 3 of the nine | the folded test |
| drop the empty-content early return | only `_empty` | the folded test
|
| lowercase `lts/<codename>` | only `_lts_codename` | the folded test |
| drop the `lts/` early return | none | none (see below) |

Finding, not changed here: the `lts/` early return has no observable
effect, because the `strip_prefix('v')` after it can never match a
string starting with `lts/`.

### What ran and what did not

- Ran at `a32a8cec` and on this branch: `cargo test -p vp_js_runtime
--lib` with `--report-time` (137/137 before, 129/129 after), `cargo
clippy -p vp_js_runtime --all-targets -- -D warnings`, `rustfmt --check`
and `git diff --check`, all clean. The workspace was loaded without
`packages/cli/binding`, which needs the `rolldown/` clone; `Cargo.toml`
and `Cargo.lock` are unchanged in this PR.
- Not run: the rest of the Rust workspace, JS tests and snapshot tests.

Open pull requests: none of the open PRs touches `dev_engines.rs`.

Ages: the nine tests were added on 2026-02-07 in #522 and #524.

To revert: `git revert 91064a5`.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01PxVsmvB9xfZKfVnUonY8kf)_

Co-authored-by: Claude <noreply@anthropic.com>