feat(FN-2939): merge fusion/fn-2939

- feat(FN-2939): complete Step 6 — add verification changeset
- test(FN-2939): complete Step 4 — tighten bundle-output coverage
- feat(FN-2946): merge fusion/fn-2946

Fusion-Task-Id: FN-2939

.changeset/fix-npm-bundle-deps.md

@@ -0,0 +1,5 @@
+---
+"@runfusion/fusion": patch
+---
+
+Verify and tighten npm bundle fixes from FN-2897: keep the vendored pi-claude-cli runtime on Node built-in child_process APIs (no cross-spawn dependency), confirm Claude CLI extension resolution works from the published dist/pi-claude-cli layout, and ensure prepack strips private @fusion/* workspace devDependencies from the published package manifest.

packages/cli/src/__tests__/bundle-output.test.ts

@@ -128,6 +128,22 @@ describe("CLI bundle output", () => {
     expect(processManagerSource).not.toMatch(/from\s*["']cross-spawn["']/);
   });
 
+  it("staged pi-claude-cli package.json keeps pi extension entry and excludes cross-spawn deps", () => {
+    const stagedPkg = JSON.parse(
+      readFileSync(join(cliRoot, "dist", "pi-claude-cli", "package.json"), "utf-8"),
+    ) as {
+      pi?: { extensions?: unknown };
+      dependencies?: Record<string, string>;
+      devDependencies?: Record<string, string>;
+    };
+
+    expect(stagedPkg.pi?.extensions).toEqual(["index.ts"]);
+    expect(stagedPkg.dependencies?.["cross-spawn"]).toBeUndefined();
+    expect(stagedPkg.dependencies?.["@types/cross-spawn"]).toBeUndefined();
+    expect(stagedPkg.devDependencies?.["cross-spawn"]).toBeUndefined();
+    expect(stagedPkg.devDependencies?.["@types/cross-spawn"]).toBeUndefined();
+  });
+
   it("runtime native assets are staged after build:exe", () => {
     const runtimeDir = join(cliRoot, "dist", "runtime");
     if (!existsSync(runtimeDir)) return;