Bump vite-plus to 1.0.0 (#632)

vite-plus 1.0.0 is the only VoidZero package that can move within the
24h minimumReleaseAge window without breaking the toolchain:

- vite stays 7.3.6: Vite 8's Oxc leaves Stage-3 decorators unlowered,
  so every workerd suite importing a `@validateRpc()` class fails with
  "SyntaxError: Invalid or unexpected token" (re-verified on 8.3.1; see
  the catalog comment).
- vitest stays ^4.1.11: @cloudflare/vitest-pool-workers 0.22.0 peers
  vitest ^4.1.0.
- @vitejs/plugin-react stays ^5.2.0: 6.x requires vite ^8.

Migration for 1.0:

- Override `vite@*` instead of bare `vite`, so vite-plus keeps its
  `vite` -> @voidzero-dev/vite-plus-core alias instead of having vite 7
  substituted under `vp`.
- Move task `env`/`input`/`output` under `cache` (vite-task#749), in the
  package configs and the shared task builders.
- Import the oxlint plugin types and RuleTester from
  `vite-plus/lint/plugins{,-dev}` and drop the separately pinned
  @oxlint/plugins dependency, its drift test and dependabot ignore.
- oxlint 1.85: use toSorted() on three freshly built arrays, and turn
  off react/globals for workshop-frontend tests, whose hook probes
  assign to an outer `let` on purpose.