Adopt lief 1.0.0 — blocked on node (25.8.2 incompatible)

[bryan-minimal]

Adopt lief 1.0.0 — blocked on node (25.8.2 incompatible)

lief was auto-bumped 0.17.6 → 1.0.0 in #416, but that PR fails to build: it's
a major release and node is the only package that depends on lief (it
links it via --shared-lief), and node 25.8.2 doesn't build against lief's 1.0
API. #416 is closed / held at 0.17.6 — bumping lief ahead of its sole consumer
breaks the one thing that uses it, for no benefit.

This issue tracks the real adoption of lief 1.0.

Why it's blocked

• packages/lief exists in our tree only to satisfy packages/node's
  --shared-lief build. Nothing else imports it.
• lief 1.0.0 restructured the API from 0.x; node 25.8.2 was written against 0.x.
• Result: the reverse-dep rebuild (node) fails on both arches. This is the
  update-safety gate working — see PACKAGE_UPDATE_SAFETY_2026-07-15.md.

Paths forward (pick when we actually need lief 1.0)

1. Bump node in lockstep to a release that supports lief 1.0 (check node's
   configure/deps for the lief version it expects), and land lief 1.0 + node
   together as one unit (base-soup-style bundle).
2. Drop node's lief dependency if it isn't load-bearing on Linux. --shared-lief
   feeds node's single-executable-application (SEA) macho/PE handling; on a Linux
   build that may be droppable (--without-lief / remove -DHAVE_LIEF). If so,
   node stops needing lief at all and we can retire the lief package.
3. Patch node to build against lief 1.0's new API (heaviest; only if 1 and 2
   don't fit).

Before doing any of this — is there a driver?

• Security: does lief 0.17.6 have an open advisory? If yes, this becomes
  urgent (path 1 or 2). If not, there's no rush — 0.17.6 is fine.
• Otherwise this is low priority: nothing needs lief 1.0 today.

Ref: #416 (the failed bump).

🤖 Generated with Claude Code