feat: make cli and nodejs packages public

[rekmarks]

• Rename packages/cli → packages/kernel-cli (@ocap/cli → @metamask/kernel-cli) and make it public
• Rename packages/nodejs → packages/kernel-node-runtime (@ocap/nodejs → @metamask/kernel-node-runtime) and make it public
• Move bundle-vats vite plugins from @ocap/repo-tools into @metamask/kernel-utils/vite-plugins so kernel-cli can depend on a public package for that functionality
• Update all monorepo-wide references (kernel-test, nodejs-test-workers, extension, omnium-gatherum, root tsconfig/eslint config)
• Rename noBuild → buildExceptions in yarn.config.cjs; add kernel-cli to exportsExceptions and buildExceptions

---

Note

Medium Risk
Primarily packaging/renaming, but it changes published artifacts, workspace dependency graph, and CI/test wiring; mistakes could break builds or consumers of the newly public packages.

Overview
This PR renames and makes public the former @ocap/cli and @ocap/nodejs workspaces as @metamask/kernel-cli and @metamask/kernel-node-runtime, adding public publishConfig, dual MIT/Apache licensing, metadata, and updating build/changelog scripts accordingly.

It moves vat bundling Vite plugin APIs (bundleVat/bundleVats and VatBundle) out of @ocap/repo-tools and into @metamask/kernel-utils/vite-plugins, then rewires the CLI, extension, and omnium-gatherum configs to import from the new public location.

Monorepo plumbing is updated to match the renames: root/workspace deps and LavaMoat allowlist entries, TS project references, ESLint file globs, Yarn constraints (noBuild→buildExceptions plus new exceptions), CI E2E workspace matrix/artifact paths, and test packages (kernel-test, nodejs-test-workers) now depend on @metamask/kernel-node-runtime/@metamask/kernel-cli instead of @ocap/*.

^{Written by Cursor Bugbot for commit 5e04b83. This will update automatically on new commits. Configure here.}

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	76.1% 🟰 ±0%	6633 / 8716
🔵	Statements	75.99% 🟰 ±0%	6739 / 8868
🔵	Functions	73.95% 🟰 ±0%	1653 / 2235
🔵	Branches	75.35% 🟰 ±0%	2468 / 3275

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/kernel-test/src/utils.ts	86.95% 🟰 ±0%	70.58% 🟰 ±0%	94.44% 🟰 ±0%	86.66% 🟰 ±0%	43, 112, 117, 158-173
packages/nodejs-test-workers/src/workers/mock-fetch.ts	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	6-34
packages/repo-tools/src/vite-plugins/index.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%

Generated in workflow #3908 for commit 5e04b83 by the Vitest Coverage Report Action

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

vite as production dependency bloats all consumers

Medium Severity

Moving vite (and acorn) from devDependencies to dependencies in the public @metamask/kernel-utils package means every consumer installing kernel-utils will pull in vite and its full dependency tree, even if they only use core utilities and never touch the ./vite-plugins subpath export. The standard pattern for vite plugins is to declare vite as a peerDependency, letting consumers provide their own version and avoiding unnecessary installation for non-plugin users.

Additional Locations (1)

• packages/kernel-utils/package.json#L116-L117