fix: prevent hoisted spinner React mismatch in Bun installs

[awesamarth]

Summary

Fix link-cli onboard crashing with Invalid hook call / Cannot read properties of null (reading 'useState') after a Bun global install. The same spinner is used by other interactive commands.

In the affected installation (macOS, Bun 1.3.14, CLI 0.18.0), Ink resolves the CLI's nested React 18.3.1, while the hoisted ink-spinner resolves global React 19.2.7. The spinner's hooks therefore use a different React instance from the renderer. This depends on the installed dependency layout; a clean install will not necessarily reproduce it.

• Bundle ink-spinner through tsup's noExternal option, keeping its React/Ink imports in the CLI's dependency scope. React and Ink themselves remain external.
• Add an opt-in packaging regression script that installs the packed CLI with Bun alongside React 19, Ink 6, and a hoisted spinner, then exercises the real onboarding spinner. It asserts the conflicting React resolution exists, uses a temporary auth file, disables command network requests, and stops before authentication/payment.
• Include a patch changeset. No command, flag, or schema changes.

Validation

• Reproduced the exact useState crash with the pre-fix tarball; the patched tarball passes the same check.

• pnpm turbo run build typecheck — passed.

• pnpm biome check . — passed.

• CLI Vitest suite — 322 tests passed; SDK Vitest suite — 137 tests passed (isolated HOME to protect local credentials).

• node scripts/test-bun-install.mjs — passed. Requires Bun and pnpm; intentionally opt-in, not part of the regular offline unit suite.

• Installed the patched tarball globally using Bun and confirmed onboarding no longer crashes on the reporting machine.

• Go SDK checks — formatting clean, go mod tidy -diff, go vet ./..., and go test -race ./... all passed (Go 1.27.1).

Validation covers the interactive startup regression, not end-to-end payment processing.

To repeat the packaging check:

pnpm install --frozen-lockfile
pnpm turbo run build
node scripts/test-bun-install.mjs
# To verify the regression against an older build:
node scripts/test-bun-install.mjs /path/to/pre-fix-cli.tgz

This is separate from #298 (Bun automatically starting a server from the default export); this PR does not address that hang.

[cla-assistant]

All committers have signed the CLA.