fix(cli): the browser download unpacks on machines without an unzip command

[miguel-heygen]

What changes for the user

On a Linux machine without the unzip command (a fresh WSL Ubuntu, slim containers), hyperframes check and render no longer fail with Failed to download chrome-headless-shell: Extraction failed: no zip archiver is available. The managed browser download now unpacks without any system tool.

Root cause

The CLI downloads chrome-headless-shell through @puppeteer/browsers. On Linux and macOS it unzips by running the system unzip. When that is missing, its only fallback is the yauzl package, which @puppeteer/browsers declares as an optional peer dependency. The CLI never installed it, so with no unzip both paths failed and the download stopped.

Fix

yauzl is now a dependency of the CLI, so @puppeteer/browsers finds its fallback unzipper. No CLI code changes: the library already tries unzip first and yauzl second. yauzl is not bundled into the CLI tarball (it is only loaded by @puppeteer/browsers at runtime), so the CLI's package size budget does not change.

Also

yauzl is listed in the Fallow ignoreDependencies, next to debug: no CLI code imports it; @puppeteer/browsers loads it at runtime.

Verification

• New unzipFallback.test.ts runs the real @puppeteer/browsers install() against a local server serving a chrome-headless-shell-shaped zip, with PATH pointing at an empty directory so no unzip is found. It checks the browser executable is unpacked. Skipped on Windows, where the library unzips with tar.exe by absolute path.
• From a clean install without yauzl, the test fails with the reported error (Extraction failed: no zip archiver is available); with it, it passes on Linux.
• The browser manager and fallback tests (60) pass 3 runs in a row; typecheck, oxlint, oxfmt and the comment ratchet are clean.

Known limits

• On the yauzl path a corrupt download is not re-downloaded automatically: @puppeteer/browsers reports Extraction failed: <archive path> and drops the zip error when it combines provider failures, so the CLI cannot tell a corrupt archive from other unzip failures. Re-running the command downloads again. Upstream note: in @puppeteer/browsers 3.2.x, install() builds its All providers failed error from each provider error's message only; keeping each error as the combined error's cause would let callers detect a corrupt archive on this path.
• The engine and producer packages, installed on their own, use full puppeteer's browser downloader, which still has no yauzl outside this repo. The published hyperframes CLI is covered.

Why this PR is small

It is a one-dependency fix with its regression tests; the lockfile change adds only yauzl and pend.

[github-actions]

Edit accuracy: accurate 2061 (base branch 2061), smooth 1546 of those

The gate passes.
Smoothness is reported in the artifact, not gated. A case fails only if it fails 2 of 3 runs.

Quarantined, measured but not gated (0)