FN-8210: repair CLI package configuration test contract

Restore the CLI package configuration test to the active test lane with current build expectations.

- Allowlist WhatsApp plugin-only tsup externals as non-runtime CLI dependencies.
- Assert the full workspace build command in the verification contract.
- Remove the stale package-config test quarantine.

Files changed:
 packages/cli/src/__tests__/package-config.test.ts | 12 +++++++++++-
 packages/cli/vitest.config.ts                     |  9 ++++-----
 2 files changed, 15 insertions(+), 6 deletions(-)

Fusion-Task-Id: FN-8210

Fusion-Task-Lineage: aa29d866-430f-4097-affa-a89d107474b2

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>

packages/cli/src/__tests__/package-config.test.ts

@@ -231,11 +231,21 @@ describe("CLI package.json publishing config", () => {
     // when adding to this list, document *why* it doesn't need to be a runtime dep
     // (transitive via another dep, only used by the Bun binary, etc.) so future
     // edits don't silently re-introduce the dockerode-class bug.
+    /*
+    FNXC:CliTests 2026-07-17-09:45:
+    FN-8210: extractStringArray("external") intentionally scans the entire tsup config, including per-plugin bundlePluginEntry externals. Optional Baileys dynamic-require helpers for the bundled WhatsApp Chat plugin are therefore allowlisted here: they must remain present in the config's external array, but are not runtime dependencies of the @runfusion/fusion CLI bin.
+    */
     const TRANSITIVE_EXTERNALS: Record<string, string> = {
       ssh2: "transitive dep of dockerode",
       "cpu-features": "transitive dep of dockerode (via ssh2)",
       "@homebridge/node-pty-prebuilt-multiarch":
         "aliased as node-pty in dependencies; the alias entry satisfies the import",
+      jimp:
+        "optional Baileys dynamic-require helper externalized only for bundled fusion-plugin-whatsapp-chat; not a @runfusion/fusion runtime dep — see tsup.config.ts bundlePluginEntry external",
+      "link-preview-js":
+        "optional Baileys dynamic-require helper externalized only for bundled fusion-plugin-whatsapp-chat; not a @runfusion/fusion runtime dep — see tsup.config.ts bundlePluginEntry external",
+      "qrcode-terminal":
+        "optional Baileys dynamic-require helper externalized only for bundled fusion-plugin-whatsapp-chat; not a @runfusion/fusion runtime dep — see tsup.config.ts bundlePluginEntry external",
       // FNXC:BuildConfig 2026-07-13-12:00: FN-7936 aliased @fusion/core to a runtime shim in bundled plugin outputs; it's no longer a tsup external, so this allowlist entry is stale.
       // "@fusion/core": REMOVED — was "plugin-entry bundling external only; not a runtime dep of the CLI bin",
       "@fusion/engine": "plugin-entry bundling external only; not a runtime dep of the CLI bin",
@@ -340,7 +350,7 @@ describe("Workspace bootstrap script contract", () => {
 
   it("defines verify:workspace in lint -> test:full -> build order", () => {
     const verifyScript = rootPkg.scripts?.["verify:workspace"];
-    expect(verifyScript).toBe("pnpm lint && pnpm test:full && pnpm build");
+    expect(verifyScript).toBe("pnpm lint && pnpm test:full && pnpm build:full");
 
     const lintIdx = verifyScript.indexOf("pnpm lint");
     const testIdx = verifyScript.indexOf("pnpm test:full");

packages/cli/vitest.config.ts

@@ -44,20 +44,19 @@ const quarantinedCliTests: string[] = [
   /*
   FNXC:CliTests 2026-06-25-14:00:
   The SQLite-to-PostgreSQL cutover (feature quarantine-sqlite-internals-tests, retry session)
-  quarantines 7 pre-existing CLI test failures observed during verify:workspace. All confirmed
-  failing on clean baseline (stash + rerun, 7 failed | 92 passed). Root causes vary:
+  quarantines pre-existing CLI test failures observed during verify:workspace. Root causes vary:
   - extension-fn-secret-get.test.ts: store.getAsyncLayer mock drift (async-satellite dual-path).
   - chat.test.ts: MessageStore.getInbox returns non-array under Node 26 node:sqlite (SQLite-path).
-  - package-config.test.ts: pi-coding-agent version drift + embedded-postgres not yet in deps.
   - skill-sync.test.ts: undocumented engine tools (fn_acquire_repo_worktree, fn_artifact_*).
   - version.test.ts: changeset script assertion drift (project now uses scripts/release.mjs).
   - dashboard.test.ts: mesh lifecycle mock assertion drift.
   - bundled-plugin-freshness.test.ts: bundled plugin build freshness drift.
   Quarantined on sight per AGENTS.md flaky-test rule so verify:workspace goes green.
-  Mirrored in scripts/lib/test-quarantine.json.
+
+  FNXC:CliTests 2026-07-17-09:45:
+  FN-8210 restores package-config.test.ts to the package lane after the direct green run proved its failures were stale tsup plugin-external and verify:workspace expectations, not flaky behavior. Its old exclusion had no matching ledger entry; do not re-quarantine without new root-cause evidence and a lockstep ledger entry.
   */
   "src/__tests__/extension-fn-secret-get.test.ts",
-  "src/__tests__/package-config.test.ts",
   "src/__tests__/skill-sync.test.ts",
   "src/__tests__/version.test.ts",
   "src/commands/__tests__/dashboard.test.ts",