feat(FN-3262): harden CLI native bundle externalization with tests

The merge adds Step 2 of the native externalization hardening for the CLI package, including a minor changeset for `@runfusion/fusion` and tests validating bundle output and package configuration behavior. The changes strengthen the contract governing how native modules are handled during the build

Fusion-Task-Id: FN-3262

packages/cli/src/__tests__/bundle-output.test.ts

@@ -80,6 +80,14 @@ describe("CLI bundle output", () => {
     expect(tsupConfig).toContain("cpSync(dashboardClientSrc, dashboardClientDest, { recursive: true });");
   });
 
+  it("keeps native module loaders externalized in tsup config", () => {
+    const tsupConfig = readFileSync(tsupConfigPath, "utf-8");
+
+    expect(tsupConfig).toContain('"dockerode"');
+    expect(tsupConfig).toContain('"ssh2"');
+    expect(tsupConfig).toContain('"cpu-features"');
+  });
+
   it("loads sqlite from Node built-ins and never from bare sqlite npm package", () => {
     const content = readFileSync(bundlePath, "utf-8");
     // The bundle must resolve sqlite through Node's built-in module.
@@ -89,6 +97,12 @@ describe("CLI bundle output", () => {
     expect(content).not.toMatch(/from\s+["']sqlite["'][^s]/);
   });
 
+  it("does not inline native artifact filenames into the bundled CLI", () => {
+    const content = readFileSync(bundlePath, "utf-8");
+    expect(content).not.toContain("sshcrypto.node");
+    expect(content).not.toContain("cpufeatures.node");
+  });
+
   it("provides require via createRequire banner", () => {
     const content = readFileSync(bundlePath, "utf-8");
     // Banner should inject createRequire for ESM CJS interop

packages/cli/src/__tests__/package-config.test.ts

@@ -78,6 +78,14 @@ describe("CLI package.json publishing config", () => {
     const deps = Object.keys(pkg.dependencies || {});
     expect(deps).toContain("ioredis");
   });
+
+  it("declares dockerode as a runtime dependency when kept external in CLI bundling", () => {
+    const deps = Object.keys(pkg.dependencies || {});
+    const devDeps = Object.keys(pkg.devDependencies || {});
+
+    expect(deps).toContain("dockerode");
+    expect(devDeps).not.toContain("dockerode");
+  });
 });
 
 describe("Scoped @fusion/* packages publishing config", () => {