fix(FN-2897): harden npm bundle packaging and merge recovery flows

- Strip private @fusion/* workspace devDependencies from the published CLI manifest via prepare-publish-manifest and package metadata updates
- Replace cross-spawn usage and add staged bundle layout assertions to verify resolver output in dist packaging
- Add per-task/project model override resolution across core, dashboard settings/task modals, and route coverage with new regression tests
- Strengthen engine merge/recovery handling for paused/interrupted/squash paths and surface merger timeline activity with additional self-healing and merger tests
- Add changesets for npm bundle dependency fixes, project model override stabilization, and FTS5 corruption recovery

Fusion-Task-Id: FN-2897

packages/pi-claude-cli/src/__tests__/process-manager.test.ts

@@ -1,9 +1,9 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import type { ChildProcess } from "node:child_process";
 
-// Mock cross-spawn before importing process-manager
-vi.mock("cross-spawn", () => ({
-  default: vi.fn(() => {
+// Mock child_process.spawn before importing process-manager
+vi.mock("node:child_process", () => ({
+  spawn: vi.fn(() => {
     const EventEmitter = require("node:events");
     const proc = new EventEmitter();
     proc.stdin = { write: vi.fn(), end: vi.fn() };
@@ -16,10 +16,6 @@ vi.mock("cross-spawn", () => ({
     proc.pid = 12345;
     return proc;
   }),
-}));
-
-// Mock child_process.execSync for validation tests
-vi.mock("node:child_process", () => ({
   execSync: vi.fn(),
 }));
 
@@ -42,8 +38,7 @@ vi.mock("node:os", () => ({
   tmpdir: mocks.tmpdir,
 }));
 
-import spawn from "cross-spawn";
-import { execSync } from "node:child_process";
+import { spawn, execSync } from "node:child_process";
 import {
   spawnClaude,
   writeUserMessage,

packages/pi-claude-cli/src/__tests__/provider.test.ts

@@ -2,9 +2,9 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { EventEmitter } from "node:events";
 import { PassThrough } from "node:stream";
 
-// Mock cross-spawn with PassThrough streams for readline compatibility
-vi.mock("cross-spawn", () => ({
-  default: vi.fn(() => {
+// Mock child_process.spawn with PassThrough streams for readline compatibility
+vi.mock("node:child_process", () => ({
+  spawn: vi.fn(() => {
     const proc = new EventEmitter();
     const stdin = { write: vi.fn(), end: vi.fn() };
     const stdout = new PassThrough();
@@ -20,10 +20,6 @@ vi.mock("cross-spawn", () => ({
     (proc as any).pid = 99999;
     return proc;
   }),
-}));
-
-// Mock child_process.execSync for validateCliPresence/validateCliAuth
-vi.mock("node:child_process", () => ({
   execSync: vi.fn(() => Buffer.from("1.0.0")),
 }));
 
@@ -69,7 +65,7 @@ vi.mock("@mariozechner/pi-ai", () => ({
   calculateCost: vi.fn(),
 }));
 
-import spawn from "cross-spawn";
+import { spawn } from "node:child_process";
 import { streamViaCli } from "../provider";
 
 describe("provider registration (default export)", () => {