Clean up unused and misplaced dependencies flagged by knip

[wojtekn]

Related issues

• Related to npx knip cleanup

How AI was used in this PR

Claude Code ran npx knip, then cross-referenced every finding against actual imports across the whole monorepo to distinguish three cases: genuinely-unused deps, deps declared in the wrong workspace, and knip false positives. Each conclusion was verified with npm why, a full npm run typecheck, and a re-run of knip. All findings and edits were reviewed by a human before opening this PR.

Proposed Changes

npx knip reported ~38 unused dependencies, but most were not actually dead — they were declared in a workspace that never imports them (knip reports per-workspace, so a dep used only from a sibling package reads as "unused" where it's declared). This PR sorts every finding into the correct bucket:

• Removed genuinely-unused deps that no code imports anywhere (compression, compressible, strip-ansi, @wp-playground/common, @wordpress/html-entities, @wordpress/rich-text).
• Removed redundant duplicate declarations where the real consumer already declares the package (e.g. http-proxy/tar/yauzl/fast-deep-equal in apps/studio that belong to apps/cli/packages/common; the express trio in apps/cli already present in apps/local/apps/hosted; patch-package duplicated from root). These packages stay installed — they're still required elsewhere — so nothing changes at runtime.
• Relocated deps to the workspace that actually uses them (electron2appx → root, used by scripts/; @types/yauzl → apps/cli).
• Fixed two knip config gaps that were generating ~24 false positives: apps/studio now lists electron.vite.config.ts as an entry, and packages/data-liberation-agent now has an entry plus .tsx in its project glob.

The result is that each workspace's package.json accurately declares what it imports, instead of relying on npm hoisting. The lockfile shrinks accordingly (only compression/compressible and their private subtree are physically removed; everything else is dedup bookkeeping).

Dev-tooling/manifest change only — no runtime or user-visible behavior changes.

A separate, pre-existing issue (knip's ~22 "unlisted" phantom dependencies — imported but declared nowhere, resolving via hoisting) is intentionally out of scope and will be handled in a follow-up.

Testing Instructions

• npm install — completes cleanly, no peer-dependency conflicts (removes the now-unreferenced compression subtree).
• npm run typecheck — passes across all six workspaces, confirming no removed/moved dep broke resolution.
• npx knip — the only remaining "unused" findings are the deliberately-kept ones (@sentry/react via Vite manualChunks, @wp-playground/cli spawned as a binary, @automattic/wp-babel-makepot via npx in a Fastfile, and hpagent/rehype-raw/@types/shell-quote which sit behind orphaned files being removed in Remove remaining unused files flagged by Knip #4393).

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[wpmobilebot]

📊 Performance Test Results

Comparing d6fce3e vs trunk

app-size

Metric	trunk	d6fce3e	Diff	Change
App Size (Mac)	1378.88 MB	1367.48 MB	11.39 MB	🟢 -0.8%

site-editor

Metric	trunk	d6fce3e	Diff	Change
load	725 ms	1106 ms	+381 ms	🔴 52.6%

site-startup

Metric	trunk	d6fce3e	Diff	Change
siteCreation	6476 ms	6600 ms	+124 ms	🔴 1.9%
siteStartup	2389 ms	2367 ms	22 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)

[bcotrim]

LGTM 👍

CI is green and I couldn't find any regressions