fix(build): pin @types/node workspace-wide; make build-exe tests opt-in

(b) Windows desktop build flakily failed with "Property 'ok'/'status' does
not exist on type 'Response'" because the workspace resolved multiple
@types/node versions (incl. an ancient 12.20.55 from @manypkg/find-root that
predates global fetch types). plugin-sdk compiles with lib:["ES2022"] and no
DOM lib, so Response comes solely from @types/node — nondeterministic across
runners. Pin via pnpm.overrides "@types/node": "^25.5.2"; collapses the
lockfile to one version. Verified: plugin-sdk build + desktop + full
workspace typecheck all pass.

Also: build-exe-cross tests cross-compiled all 5 platforms on every CI run
(auto-enabled via Boolean(process.env.CI)) — a release-build dependency in
the normal lane. Made them opt-in (FUSION_TEST_BUILD_EXE=1) and pointed the
root test:slow-cli at the CLI slow lane instead of test:pre-release, so
everyday CI no longer depends on release builds. test:pre-release and
test-release.yml still validate binaries deliberately.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

package.json

@@ -44,7 +44,7 @@
     "test:coverage:engine": "pnpm --filter @fusion/engine exec vitest run --silent=passed-only --reporter=dot --coverage",
     "test:coverage:cli": "pnpm --filter @runfusion/fusion exec vitest run --silent=passed-only --reporter=dot --coverage",
     "test:coverage:dashboard": "pnpm --filter @fusion/dashboard exec vitest run --silent=passed-only --reporter=dot --coverage",
-    "test:slow-cli": "pnpm --filter @runfusion/fusion test:pre-release",
+    "test:slow-cli": "pnpm --filter @runfusion/fusion test:slow-cli",
     "typecheck": "pnpm -r --filter=!@fusion/desktop --filter=!@fusion/mobile typecheck",
     "changeset": "changeset",
     "version": "changeset version",
@@ -66,7 +66,10 @@
       "esbuild",
       "koffi",
       "protobufjs"
-    ]
+    ],
+    "overrides": {
+      "@types/node": "^25.5.2"
+    }
   },
   "devDependencies": {
     "@changesets/cli": "^2.30.0",