fix(package): drop the unused @rolldown/binding-linux-x64-gnu optionalDependency — it ships a 20 MB bundler binary to every consumer

[Shinrai]

Problem

The published package.json declares:

"optionalDependencies": { "@rolldown/binding-linux-x64-gnu": "1.1.3" }

Nothing in slothlet uses it — grep -r rolldown dist src → 0 hits. It was added in the v3.3.1 release commit 8c32dd9b (2026-04-29), alongside a rolldown override, apparently to get vitest's native binding installed in CI. It is still present in 3.20.0.

Because it is an optionalDependency (not a devDependency), every consumer installs it, and any tool that stages a package's runtime closure (dependencies + optionalDependencies) ships it to production. In @cldmv/rummage web deploys it is a 20 MB Linux build of a bundler sitting in the server runtime tree — the only build-only package found there (CLDMV/rummage#73).

Fix

• Remove @rolldown/binding-linux-x64-gnu from optionalDependencies.
• If CI genuinely needs it for vitest on linux-x64, declare it as a devDependency (or install it in the CI workflow step) so it never reaches consumers.
• Verify with npm pack --dry-run / a clean consumer install that no @rolldown/* package is pulled in.

Downstream

CLDMV/rummage#73 — once a slothlet release carries this, the rummage runtime staging drops the package with no consumer-side special-casing.

[Shinrai]

Landed on next in #493 (6d73b890). The binding is removed from optionalDependencies outright rather than moved to devDependencies: it's locked to linux-x64-glibc, so a hard devDependency would fail npm install on macOS/Windows (EBADPLATFORM). The lockfile already records every platform's binding under rolldown's own optional dependencies, and a clean npm ci still installs it and runs vitest. npm ls rolldown --omit=dev is empty, so nothing reaches consumers. The Dependabot ignore rule that only pinned it was removed too. Ships with the next release.

[cldmv-bot]

Closed in v3.22.0 — resolved by #493.