refactor(tools): extract zip utilities into shared @aws-cdk/tools package

[mrgrain]

Both cdk-assets-lib and toolkit-lib carried their own copy of zip utilities (zipDirectory, zipString) wrapping archiver and fast-glob. This duplication made it easy for the implementations to drift apart — the toolkit-lib version had already lost the deterministic date reset, for example.

This PR introduces a new private (unpublished) @aws-cdk/tools package that hosts small, self-contained utilities. Each tool lives in its own subdirectory under lib/, gets compiled by tsc, and then bundled into a single file by esbuild. Consumer packages cherry-pick tools at pre-compile time via a useTools option on the new CdkTypeScriptWorkspace projen construct, which copies the bundled .js and .d.ts into lib/private/tools/<name>/.

The immediate benefit is that archiver is no longer a direct runtime dependency of either cdk-assets-lib or toolkit-lib — it's bundled once in @aws-cdk/tools and the output is vendored. Future utilities (e.g. hashing helpers, retry wrappers) can be added by simply creating a new lib/<tool>/index.ts in the tools package.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Total lines changed 1858 is greater than 1000. Please consider breaking this PR down.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 2 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.
• ⚠️ 2 packages with OpenSSF Scorecard issues.

View full job summary