fix(build): fix runtime bugs in build scripts

[jdalton]

Summary

• Fix plugin ordering in esbuild.cli.build.mjs: envVarReplacementPlugin was running before unicodeTransformPlugin despite comment saying "must run AFTER unicode transform". Swapped order.
• Fix watch mode crash in build.mjs: watchResult?.code can be undefined when spawn returns null. Added null check with ?? 1 fallback.
• Fix Promise.all -> Promise.allSettled pattern in build.mjs, download-assets.mjs, and download-iocraft-binaries.mjs: Promise.all short-circuits on first rejection, swallowing other results. Promise.allSettled with r.status === 'rejected' properly catches all failures.
• Fix createBuildRunner in esbuild-shared.mjs: catch block never rethrew, so callers using allSettled could not detect failures.
• Remove dead script entries from cli/package.json (e2e:smol, build:sea:internal:bootstrap, publish:sea).

Split from #1140.

Test plan

• pnpm --filter @socketsecurity/cli run build succeeds
• pnpm --filter @socketsecurity/cli run build --watch handles spawn failures gracefully
• Asset download scripts report all failures (not just the first)

---

Note

Medium Risk
Touches the CLI build pipeline (esbuild config, asset downloads, post-processing), so failures could block releases; changes are localized and mostly improve error handling and ordering.

Overview
Fixes several CLI build/runtime edge cases by correcting esbuild plugin ordering so envVarReplacementPlugin runs after unicodeTransformPlugin, and by hardening watch-mode spawn handling when spawn() returns null.

Build and download scripts now use Promise.allSettled (and createBuildRunner rethrows on failure) so parallel steps reliably surface all failures instead of short-circuiting on the first rejection, with clearer error output. Also removes a few unused package.json scripts (publish:sea, e2e:smol, build:sea:internal:bootstrap).

^{Written by Cursor Bugbot for commit 9478197. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR