feat(sea): build Socket 2.1.0-rc.0 as Node 27 SEA

.claude/skills/bump-coana/SKILL.md

@@ -47,7 +47,7 @@ PRs.
 
 🚨 **Do NOT touch `package.json`'s top-level `version` field.** The release workflow owns it:
 between releases the manifest holds the last released version, and
-`scripts/release/bump.mts` derives and writes the next one in-run. Hand-writing
+`scripts/release/prepare.mts` derives and writes the next one in-run. Hand-writing
 it invents a version that never releases and breaks the next release — a manifest
 already sitting on the version being released has no line for the bump to
 advance.

.config/release.json

@@ -0,0 +1,6 @@
+{
+  "mode": "prerelease-only",
+  "versionHint": "2.1.0",
+  "identifier": "rc",
+  "distTag": "rc-2.1.0"
+}

.config/rollup.base.config.mjs

@@ -21,6 +21,7 @@ import {
   isBuiltin,
   normalizeId,
 } from '../scripts/utils/packages.js'
+import { includedModulesInventoryPlugin } from '../src/sea/rollup-provenance.mjs'
 
 const {
   INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION,
@@ -229,7 +230,11 @@ export default function baseConfig(extendConfig = {}) {
           ],
           [
             INLINED_SOCKET_CLI_VERSION,
-            () => JSON.stringify(getRootPkgJsonSync().version),
+            () =>
+              JSON.stringify(
+                constants.ENV.INLINED_SOCKET_CLI_VERSION ||
+                  getRootPkgJsonSync().version,
+              ),
           ],
           [
             INLINED_SOCKET_CLI_VERSION_HASH,
@@ -289,6 +294,15 @@ export default function baseConfig(extendConfig = {}) {
         },
       }),
       ...extendPlugins,
+      ...(process.env.SOCKET_SEA_BUILD === 'true'
+        ? [
+            includedModulesInventoryPlugin({
+              root: rootPath,
+              inventoryFile: 'THIRD-PARTY-NOTICES.json',
+              bundleId: 'core-rollup',
+            }),
+          ]
+        : []),
     ],
   }
 }