Remove deepmerge in favor of a local implementation - #8281

WHY are these changes introduced?

Part of an effort to reduce external dependencies in the CLI. deepmerge is used in a single function (deepMergeObjects in cli-kit), and the subset of its behavior we rely on fits in ~50 lines.

WHAT is this pull request doing?

Replaces the deepmerge package with a local implementation in packages/cli-kit/src/public/common/object.ts that preserves deepmerge v4 semantics as used by deepMergeObjects:

• Custom array merge strategies (union strategy by default), applied also when cloning nested arrays — matching deepmerge's clone-through-arrayMerge behavior that existing tests depend on.
• Nested values are cloned, so the result shares no references with the inputs.
• Date and RegExp are treated as leaf values, not merged into plain objects.
• Unsafe keys (__proto__, etc.) that exist on the prototype chain but are not own enumerable properties are skipped, keeping deepmerge's prototype-pollution guard.

No changeset: internal refactor with no user-visible behavior change.

How to test your changes?

• pnpm vitest run src/public/common/object.test.ts in packages/cli-kit (29 tests pass)
• Consumer suites in packages/app (app.test.ts, patch-app-configuration-file.test.ts, config/link.test.ts, select-app.test.ts, dev/extension/payload/store.test.ts — 85 tests pass)
• pnpm type-check in packages/cli-kit

Measuring impact

• n/a — internal dependency cleanup

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes

🤖 Generated with Claude Code