fix(rolldown): always externalize node:* regardless of CONFIG.external

[vitbokisch]

The robustness gap

`node:*` externalization was added to `baseConfig.external` — a user-overridable default. But `deepMerge` replaces arrays wholesale, so any package that sets its own `external` in `vl-tools.config.mjs` (e.g. to add `echarts` subpaths) silently dropped the `/^node:/` default and started emitting `UNRESOLVED_IMPORT` warnings on every `node:fs`/`node:path`/etc. import again.

Reproduced: a probe package with `external: [/^echarts/]` → 1 `node:` UNRESOLVED_IMPORT warning (was 0 with the default). It's not charts-specific — any package overriding `external` for any reason re-opens the whole class.

The fix

A `node:` import is never a real module a library could bundle — it's a hard invariant, not a "default you might override." Moved it out of the overridable `baseConfig.external` into an `ALWAYS_EXTERNAL` constant that `resolveExternals` spreads in unconditionally:

```ts
const ALWAYS_EXTERNAL: (string | RegExp)[] = [/^node:/]

const resolveExternals = () =>
CONFIG.bundleAll ? []
: [...PKG.externalDependencies, ...ALWAYS_EXTERNAL, ...CONFIG.external].map(expandExternal)
```

A package's `external` override is still honored (their entries are added); it just can't drop node-builtin externalization anymore.

Regression lock (proven)

Two unit tests — package overrides `CONFIG.external`; `CONFIG.external` empty. Verified by reverting the fix:

	node:fs external?
Fix in place	✅ both tests pass
Fix reverted	❌ both tests fail

Plus end-to-end: full monorepo build emits 0 `node:*` UNRESOLVED_IMPORT warnings, probe package overriding `external` keeps `node:fs` external.

On the SOURCEMAP_BROKEN concern (investigated, no change)

The "isolated DTS path didn't get the sourcemap-off treatment" claim does not reproduce. Both the isolated and grouped DTS paths consume configs from `createDtsConfig`, which already sets `dts({ sourcemap: false })`. A single-entry (isolated-path) build emits 0 SOURCEMAP_BROKEN warnings. The 8 warnings the reporter saw were likely on a pre-#159 build. No change needed.

e2e

• ✅ 587 tests pass (+2 new)
• ✅ Lint + typecheck clean across all 10 packages
• ✅ All 10 packages build, 0 node:* warnings
• ✅ Zero leaked `__dts_tmp*` dirs

Versioning

`@vitus-labs/tools-rolldown`: patch → 2.6.3.

🤖 Generated with Claude Code