fix(cli): don't crash on empty bundle list or hoisted monorepo deps

[posthog-eu]

Summary

Two normal situations make the CLI exit non-zero instead of behaving sensibly. This fixes both, plus a fingerprint quirk that hides their true reach.

• Empty bundle list crashes. bundle list on an app with zero bundles printed Active versions in Capgo: 0 and then threw No bundle found on that same empty array — skipping outro('Done ✅') and exiting 1. Nastiest in CI, where exit 1 fails the job. displayBundles now renders an empty state and returns; bundle cleanup (same call site) is fixed for free.
• Hoisted monorepo deps read as missing. Dependency enumeration (getAllPackagesDependencies) walks up parent directories for hoisted node_modules, but the validation in getLocalDependencies only checked a flat [cwd()/node_modules]. Anything hoisted to a workspace root therefore failed with Missing dependencies or invalid dependencies, blocking bundle upload / doctor. Validation now uses the same parent-directory walk, so enumeration and validation agree.
• Every release minted a new error-tracking issue. The exception fingerprint baked in cli:${version}, so the identical bug became a brand-new "1 user" issue on each release. The CLI version is now excluded from the fingerprint (still sent as distinct_id / cli_version).

Also drops a .catch(() => []) in getLocalDependencies that swallowed genuine node_modules read errors into an empty array.

Test plan

• bun test/test-posthog-exception.mjs — asserts the fingerprint no longer contains the CLI version.
• bun test/test-native-dependencies.mjs — adds a monorepo-hoisting scenario (dep at the workspace-root node_modules, resolved from the app dir with no --node-modules).
• bun run typecheck and bun run lint pass.

Screenshots

N/A — CLI exit-code / error-handling change.

Checklist

• My code follows the code style of this project and passes bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce my tests.

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing posthog-self-driving/fixcli-stop-throwing-on-empty-bundle-cd0241 (8a81fa9) with main (60a641e)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud