- collapsible_match: fold the bounds check into the KeyCode::Down match
  arm guard in vite_install package_manager
- unnecessary_sort_by: switch descending sorts in vite_js_runtime and
  vite_setup to sort_by_key with std::cmp::Reverse
- unnecessary_trailing_comma: drop trailing comma in a help.rs test
  assertion

bundleVitest copied vitest's distribution into packages/test/dist
without cleaning the directory first. When the upstream vitest
version changed, the new build emitted hashed chunks with new names
(e.g. cac.<new-hash>.js) but stale chunks from the previous version
lingered. The later brandVitest step iterates every cac.*.js chunk
looking for cac("vitest") and threw when it hit a stale chunk whose
pattern was absent or already rewritten, breaking pnpm bootstrap-cli.

Clear dist/ at the start of bundleVitest so each build starts from
a known-empty tree.

The npm-published rolldown@1.0.1 binding enables the mimalloc v3
feature (`crates/rolldown_binding/Cargo.toml` rolldown#9349), which
panics with `[internal exception] blocking task ran twice` in tokio
when tsdown drives rolldown through vp pack on darwin-arm64. The
result is that vp pack exits silently after "Build start", which
breaks every CLI snap test that bundles via vp pack (command-pack,
command-pack-exe, command-pack-external, command-pack-monorepo,
vp-cache-monorepo-missing, vp-pack-cache-disabled).

Force the binding download to use rolldown@1.0.0 while keeping the
1.0.1 JS sources (and the pluginutils relocation that depends on
them). The 1.0.0 binding is ABI-compatible with the surface vite-plus
exercises through tsdown/rolldown. Revert once an upstream rolldown
release ships without mimalloc v3 or fixes the panic.

The command-staged-broken-config snap.txt also rolls back to its
pre-PR form because the diagnostic prefix comes from the binding's
bundled oxc — `Error: Unexpected token` (1.0.0/oxc 0.128) vs.
`Unexpected token` (1.0.1/oxc 0.130).

Match the lighter-weight handling from #1569:

- packages/core/package.json: collapse the two pluginutils exports back
  to single .mjs strings. TypeScript already resolves a sibling .d.mts
  for an .mjs path under moduleResolution: bundler / node16, so the
  explicit `types` entries were redundant.
- packages/tools/src/sync-remote-deps.ts: drop the parallel .mjs
  branch in transformPluginutilsExport — once we stop wrapping string
  exports into objects, the matching `types` derivation isn't needed
  either.
- .github/actions/build-upstream/action.yml, justfile: drop the
  `pnpm --filter @rolldown/pluginutils build` step. Since rolldown
  moved pluginutils out of its workspace into a standalone npm
  package (rolldown/plugins), no workspace package matches that
  filter — the step was a silent no-op (`No projects matched the
  filters`).

The justfile's build recipe and the root package.json's build script
had drifted: the justfile knew it needed to build rolldown's native
binding, rolldown's JS, and vite's types before the @voidzero-dev/*
chain, while package.json's build only ran the @voidzero-dev/* +
vite-plus step. That meant pnpm bootstrap-cli (which calls pnpm build)
silently produced an incomplete tree on fresh checkouts — packages/
core/dist/vite/node/index.d.ts wouldn't exist, and vp check then
failed with TS7016 on every @voidzero-dev/vite-plus-core import.

Move the upstream prerequisites into the pnpm build script and have
the justfile recipe just call pnpm build, so the build sequence has a
single source of truth. CI is unaffected: bootstrap-cli:ci runs only
pnpm install-global-cli, and the per-target build-upstream action
keeps its own chain (it skips build-binding:release because the
binding is pulled from npm, and runs build-ts instead of build because
NAPI bindings are built and cached as a separate step).