feat(manager/aube): add aube manager

[JP-Ellis]

Changes

Adds a new aube manager for aube, a Node.js package manager by jdx (author of mise). aube consumes a standard package.json and resolves dependencies into an aube-lock.yaml lock file, refreshed by running aube install.

Requested in discussion #42866.

What the manager does

• Extract : pairs each aube-lock.yaml with its sibling package.json, reusing npm's existing extractPackageJson/resolveNpmrc logic. Full workspace support (the workspaces: [...] array form and the workspaces: { packages: [...] } object form).
• Artifacts: refreshes aube-lock.yaml by shelling out to aube install (with --ignore-scripts when scripts are disallowed), including npmrc/host-rules handling and lock-file-maintenance.
• Registration: index.ts mirrors the npm-family managers (supersedesManagers: ['npm'], npm + github-tags datasources, supportsLockFileMaintenance), plus registration in the manager api.ts, toolDefinitions/allToolConfig (@endevco/aube on the npm datasource), and the ignoreScripts supported-managers list.

Reuse of the bun manager

aube is architecturally near-identical to the existing bun manager (both consume package.json and maintain their own lock file via a CLI). To avoid duplicating the workspace-matching logic across the two managers, the shared helper was extracted from bun/utils.ts into npm/workspaces.ts, and bun was updated to import from the new shared location. The old bun/utils.ts and its spec were removed. aube then consumes the same helper. No behavioural change to bun.

While building aube against bun as the template, I suspect I found two bugs in the existing bun manager that would have been copied verbatim. They are fixed in aube here (aligning with the more-correct npm/artifacts.ts reference), and left untouched in bun, but I'm flagging them here for possible follow-up:

1. Crash on "workspaces": null. The nested-packages check typeof workspaces === 'object' && 'packages' in workspaces throws TypeError: Cannot use 'in' operator to search for 'packages' in null, because typeof null === 'object'. Since the extract phase runs all managers under a single Promise.all with no per-manager catch, a repo whose package.json contains "workspaces": null would abort extraction for every manager in the run. aube guards against null and adds a regression test.
2. .npmrc not reset on the install error path. npm/artifacts.ts resets the temporarily-mutated .npmrc on both the success and error paths; bun/artifacts.ts only resets on success. On any aube install failure this would leave a host-rule-derived .npmrc (which can carry registry auth tokens) on disk for subsequent steps. aube resets in the catch block, matching npm.

Note on binary dependency

For this to be fully supported, this manager requires access to the aube binary to run aube install. A similar PR to this one for mise will be needed upstream so that Renovate's containerbase can ship an aube installer.

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

This PR originates from discussion #42866.

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

• Yes: substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation). Commit trailers attribute the AI tool used, and a human reviewed the results before opening the PR.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Newly added/modified unit tests, or