fix(types,quality): revert Object.create(undefined) regression + finish null→undefined flip

Resolves task #51.

Critical fixes:
* Object.create(undefined) → Object.create(null) across 6 files
  (packages/cli/{src/utils,test/helpers}, test/unit/bootstrap). The
  prior autofix replaced `null` with `undefined`, which makes
  Object.create throw a TypeError at runtime — `null` is the
  documented prototype sentinel.
* packages/cli/scripts/wasm.mts: unterminated string literal
  ('Keeping existing file\n') fixed.

Type alignment with the prior null→undefined autofix:
* 18 packages/cli/src/{commands,utils,test} files: `T | null` types
  flipped to `T | undefined` to match call-site values.
* detect-manifest-actions.mts: `sockJson: SocketJson | null` →
  `| undefined` (param's sentinel meaning was already undefined-based;
  comment updated to match).
* test-builder.mts, cli-process-pool.mts: pool refs flipped.

SDK schema literals (`nextPage: string | null` returned by the public
SDK) kept their `null` value with inline disables — the schema is
external API contract.

Also picks up the sort-source-methods autofix from socket-wheelhouse.
Iterated `oxlint --fix` to convergence: 1729 → 1472 lint violations
(no-dynamic-import / no-status-emoji / prefer-exists-sync need
judgment-call fixes that the autofix doesn't attempt).

Author: jdalton

.claude/hooks/claude-md-size-guard/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "verbatimModuleSyntax": true
+  }
+}

.claude/hooks/no-revert-guard/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "declarationMap": false,
+    "erasableSyntaxOnly": true,
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "noEmit": true,
+    "rewriteRelativeImportExtensions": true,
+    "skipLibCheck": true,
+    "sourceMap": false,
+    "strict": true,
+    "target": "esnext",
+    "verbatimModuleSyntax": true
+  }
+}

.config/oxlint-plugin/rules/_inject-import.js

@@ -0,0 +1,110 @@
+/**
+ * @fileoverview Shared helper for rule fixers that need to inject
+ * an `import { Name } from 'specifier'` statement (and optionally a
+ * matching hoisted `const`) into a file.
+ *
+ * Fixers call `summarizeImportTarget(programNode, specifier, importName)`
+ * to learn the file's current shape, then `appendImportFixes(...)`
+ * inside their `fix(fixer)` callback to add the missing pieces.
+ *
+ * ESLint's autofixer dedupes overlapping inserts at the same range,
+ * so multiple violations in the same file can each emit the import
+ * insertion safely — only one survives.
+ */
+
+/**
+ * Walk a Program node body once and figure out:
+ *   - the last top-level ImportDeclaration node (or undefined)
+ *   - whether `importName` is already imported (from ANY source)
+ *   - whether a top-level `localName` identifier already exists
+ *     (any const/let/var or import-as-local with that name)
+ *
+ * Import detection ignores the specifier path: a file inside the lib
+ * package itself imports `getDefaultLogger` from `'../logger'`, while
+ * a downstream repo imports the same name from
+ * `'@socketsecurity/lib/logger'`. Both resolve to the same identifier;
+ * either should count as "already imported" so the autofix doesn't
+ * inject a duplicate (and broken — see issue #64).
+ *
+ * `specifier` is retained in the signature for backward compatibility
+ * but is no longer used for the match decision. Callers may pass any
+ * truthy value (typically the canonical package path the rule would
+ * inject if the import were missing).
+ */
+export function summarizeImportTarget(
+  program,
+  // eslint-disable-next-line no-unused-vars
+  specifier,
+  importName,
+  localName,
+) {
+  let lastImport
+  let hasImport = false
+  let hasLocal = false
+  for (const stmt of program.body) {
+    if (stmt.type === 'ImportDeclaration') {
+      lastImport = stmt
+      for (const spec of stmt.specifiers) {
+        if (
+          spec.type === 'ImportSpecifier' &&
+          spec.imported &&
+          spec.imported.name === importName
+        ) {
+          hasImport = true
+        }
+        if (
+          localName &&
+          spec.local &&
+          spec.local.name === localName &&
+          (spec.type === 'ImportSpecifier' ||
+            spec.type === 'ImportDefaultSpecifier' ||
+            spec.type === 'ImportNamespaceSpecifier')
+        ) {
+          hasLocal = true
+        }
+      }
+      continue
+    }
+    if (localName && stmt.type === 'VariableDeclaration') {
+      for (const decl of stmt.declarations) {
+        if (
+          decl.id &&
+          decl.id.type === 'Identifier' &&
+          decl.id.name === localName
+        ) {
+          hasLocal = true
+        }
+      }
+    }
+  }
+  return { hasImport, hasLocal, lastImport }
+}
+
+/**
+ * Build the fixer-side inserts for missing import + optional hoist.
+ * Returns an array of fixer operations the caller appends to its own
+ * fix() return value.
+ *
+ *   summary       — output of summarizeImportTarget()
+ *   fixer         — the fixer passed to context.report({ fix })
+ *   importLine    — the literal `import { ... } from '...'` text
+ *   hoistLine     — optional; the literal `const x = ...()` text
+ */
+export function appendImportFixes(summary, fixer, importLine, hoistLine) {
+  const ops = []
+  if (!summary.hasImport) {
+    if (summary.lastImport) {
+      ops.push(fixer.insertTextAfter(summary.lastImport, `\n${importLine}`))
+    } else {
+      ops.push(fixer.insertTextBeforeRange([0, 0], `${importLine}\n`))
+    }
+  }
+  if (hoistLine && !summary.hasLocal) {
+    if (summary.lastImport) {
+      ops.push(fixer.insertTextAfter(summary.lastImport, `\n\n${hoistLine}`))
+    } else {
+      ops.push(fixer.insertTextBeforeRange([0, 0], `${hoistLine}\n\n`))
+    }
+  }
+  return ops
+}