[joeblau]

Closes #101
Closes #102
Closes #103
Closes #104

What changed

Four CI-only gates. No library code under packages/chart/src changes, so the published dist/ is byte-identical to main.

• Invariant: @bloxwap/chart has zero runtime dependencies (react only as optional peer, only in ./react) #101, zero runtime deps: npm run check:dependencies fails if packages/chart/package.json gains dependencies or optionalDependencies, or if react stops being the only optional peer. It also scans all 143 dist/**/*.js files for bare import/export … from/import() specifiers. Only react and react/jsx-runtime under dist/react/ are allowed. node: builtins and computed specifiers fail.

• Invariant: package.json sideEffects:false is accurate and entry points stay tree-shakable #102, tree-shaking: npm run check:tree-shaking checks sideEffects:false, then uses bun build --minify to bundle fixtures from an installed copy of the package:

  Fixture	Size	Budget	WASM kernel
  parseColor	1,762 B	2,400 B	must be absent
  smaValues (/indicators)	556 B	800 B	must be absent
  createChart	176,960 B	240,000 B	must be present

• Invariant: tsrs is pinned to the same exact version everywhere and the tsc fallback keeps passing #103, tsrs pins: npm run check:tsrs requires every workspace's tsrs pin to be identical and exact, and requires tsrs and @tsrs/* to resolve to that version in both lockfiles. CI now also runs bun run typecheck:tsc after the coverage build. renovate.json groups tsrs and @tsrs/* so Renovate updates them together.

• Invariant: package-lock.json and bun.lock resolve the same dependency tree #104, lockfile sync: npm run check:lockfiles compares package names and resolved versions in bun.lock and package-lock.json, excluding workspace links. Today: 391 names and 393 name/version pairs, 0 mismatches. The README line about "one root lockfile" now describes both lockfiles.

npm run check:invariants runs all four checks, then 19 node:test regression tests. Those tests run each check against a temporary broken fixture (a runtime dependency, a required React peer, React leaking into core, a bare import or re-export, a dynamic builtin import, a kernel leak, a budget overrun, ^ and drifted tsrs pins, platform-binary drift in each lockfile, and an npm-only, bun-only or nested-version mismatch), and each one fails as expected. The gates are documented in docs/ci-runners.md.

Proof

• npm run check:invariants: all four checks pass, and 19/19 regression tests pass.
• npm run typecheck:tsc, npm run lint and npm run build: all pass.
• Library tests and coverage are unchanged, because no src or test files change. The CI coverage gate still enforces 100%.
• Benchmarks: no runtime code changed, so the hot paths (setData, appendData, render) can't regress.