chore: vitest 5 migration blockers (CI verification only, do not merge)

[kanadgupta]

Warning

Do not merge. This is a CI-verification PR stacked on #6456 (Vitest 5 projects exploration). It stays a draft and carries the run-ci label so the full develop suite runs against it; the commits will be folded into the real migration PR.

Summary

Adds the fixes needed for the Vitest 5 upgrade in #6456 to pass CI, as additional commits on top of that branch.

• Bump @vitest/coverage-istanbul to 5.x. The 4.x provider crashes under Vitest 5 with Expected string coverage payload, received object, which breaks the --coverage.enabled unit and integration jobs. @vitest/coverage-istanbul@5.0.0 shipped the same day as vitest@5.0.0, so it gets the same minimumReleaseAgeExclude entry.
• Accept Vitest 5 as the @effect/vitest peer. Every @effect/vitest 4.0.0-rc.x pins vitest <5, but it only uses the stable entrypoint and the full unit and integration suite passes on Vitest 5. A peerDependencyRules.allowedVersions entry records the deliberate override so installs stop warning; drop it once upstream widens the range.
• Keep knip's Vitest plugin off at the repo root. Declaring vitest in the root manifest enabled knip's Vitest plugin for the root workspace. It followed the root config's projects globs and re-analyzed every package's test files as root entries, which misattributed the dependencies of the release scripts under apps/cli/scripts and packages/config/scripts and failed knip:check with four "unused" devDependencies. The root config is registered as a plain entry instead, and the package-level plugins keep analyzing their own configs.
• Ignore .vitest/. Vitest 5 centralizes reporter and attachment artifacts there.

Step 2: one shared preset for the package configs

vitest.shared.ts at the repo root now owns the scaffolding every workspace repeated: istanbul coverage, passWithNoTests, quiet output from passing tests, the bun export-condition resolution, and the unit/integration/e2e/live include globs. Package configs shrink to definePackageConfig({ test: { projects: [testProject("unit"), ...] } }) plus genuinely package-specific overrides such as timeouts, setup files, or the CLI's Dockerfile loader plugin. Vitest 5 inherits the declaring config into inline projects, so the resolve blocks that Vitest 4 forced onto every inline project are gone.

apps/cli-e2e becomes a nested e2e project so it appears as @supabase/cli-e2e (e2e) from the root and matches a *(e2e) filter. Its lexicographic sequencer remains a run-level option that applies to standalone runs. vite is an explicit root devDependency because the preset imports its default export-condition lists.

Standalone per-package runs, the CI coverage commands, and a root run collect exactly the same projects and test counts as before.

The remaining process.cwd() uses in tests were audited and are safe under root invocation (restore-after-chdir, a default argument, and a virtual-filesystem parser), so no test changes were needed beyond the one already in #6456.

🤖 Generated with Claude Code