Vendor the Karma rollup preprocessor

[itsjamie]

This PR will...

Vendor karma-rollup-preprocessor into scripts/karma-rollup-preprocessor.js and drop the git dependency. Its two runtime dependencies, chokidar and debounce, become direct devDependencies.

Why is this Pull Request needed?

npm 12 changed the allow-git default from all to none, so npm ci refuses the dependency outright:

npm error code EALLOWGIT
npm error Fetching packages of type "git" have been disabled
npm error Refusing to fetch "karma-rollup-preprocessor@git+ssh://git@github.com/jlmakes/karma-rollup-preprocessor.git#7a7268d91149307b3cf2888ee4e65ccd079955a3"

No Node release bundles npm 12 yet. The newest is npm 11.19.0 in Node v26.7.0, and npm 11 still defaults allow-git to all, so this only bites people who have upgraded npm on their own for now. It becomes everyone's problem the first time a Node release picks up npm 12, so I would rather not be holding a git dependency when that lands.

We pinned that ref in #5991 because the published 7.0.8 leaks in watch mode, getting slower until it crashes (jlmakes/karma-rollup-preprocessor#78). Only two commits exist after that release:

7a7268d91  test: New test with @rollup/plugin-typescript.   <- what we pin
87970358f  Revert "use rollup watch when in watch mode"

So the pin buys us the revert, and the commit we actually point at is test-only. There has been no release since June 2022 and no commit since March 2023, so there is nothing to upgrade to. The package is a single ~110 line MIT file, which is small enough to carry ourselves.

Are there any points in the code the reviewer needs to double check?

One behaviour change in the vendored file. The output loop selected chunks with !result.isAsset, a field Rollup removed in 3.x, so it read as always-true. It now tests result.type !== 'chunk'. No effect on our output, which is a single chunk with no assets, but worth a look.

The alternative is a committed .npmrc with allow-git=root, which scopes the permission to git dependencies declared in our own package.json. I tested it and it works for both npm install and npm ci, and it is two lines rather than 149. I went with vendoring because it removes the dependency instead of re-permitting it, and because upstream is dormant with no registry copy to fall back on if that GitHub ref ever moves. I am happy to switch if you would rather keep the dependency and add the .npmrc.

To reproduce:

npm ci
npm run test:unit
npx karma start karma.conf.js --auto-watch --no-single-run

npm run test:unit should report 1181 passing. For the watch run, touch src/utils/binary-search.ts and you should see a second Generating bundle and a full rerun, which is the dependency-graph watching the git pin existed to preserve.

Resolves issues:

Checklist

• changes have been done against master branch, and PR does not conflict
• new unit / functional tests have been added (whenever applicable)
• API or design changes are documented in API.md