Dependency hygiene: replace colors with picocolors, drop async [#1530]

[ricardo-devis-agullo]

Summary

Implements #1530 (v1 Track 1 / non-breaking 0.x dependency & supply-chain hygiene).

• Replace unmaintained colors with maintained, dependency-free picocolors
• Centralize all terminal coloring behind packages/oc/src/utils/colors.ts so future swaps touch one module
• Remove unused direct async + @types/async (only used by the mocha test runner task; rewritten with native promises)
• Preserve existing success/info/warn/error coloring semantics and startup messages
• No public API / config / HTTP / component behavior changes

ESM-only dependency audit (current CJS build)

Analyzed against installed package metadata + CJS require behavior. Documentation only — no forced upgrades in this PR.

Package	Version	type	Current CJS build status	Notes for v1 ESM switch
open	10.2.0	module (ESM-only)	Works today via Node CJS↔ESM interop (require('open') returns module namespace; default used as callable in some paths / Promise API used as await open(href))	Prefer static/dynamic import; re-check default-export interop after dual-build removal
serialize-error	12.0.0	module (ESM-only)	Works today via CJS interop (serializeError named export available on require)	Native ESM import { serializeError } is the natural form at v1
picocolors	1.1.1	dual (CJS main)	Fine	Trivial under ESM
@rdevis/turbo-stream	2.4.1	dual (exports import+require)	Fine	Already has proper dual exports
@kitajs/html	4.2.13	commonjs	Fine	Dual-ish; no blocker
undici	8.5.0	CJS main	Fine	No blocker
chokidar	4.0.3	dual exports	Fine	Already dual
dotenv	17.4.2	dual exports	Fine	No blocker
builtin-modules	3.3.0	CJS	Fine	No blocker
source-map	0.7.6	CJS	Fine	No blocker

Hard blockers for v1 ESM: none found among the deps above. The main v1 work remains converting our packages to ESM-only + exports maps, not replacing these deps. open and serialize-error already ship ESM-only and interop today; they are the ones to re-smoke after the package-format switch.

Residual async: removed as a direct dependency of oc. It remains transitive via template compilers (oc-template-*-compiler → oc-statics-compiler / oc-generic-template-compiler). Out of scope here (separate dep hygiene).

Test plan

• npm run build (full monorepo turbo build) — pass
• npm run test-silent --workspace=oc — 943 passing
• Confirmed no remaining colors / direct async imports in packages/oc
• Spot-check: color helper emits ANSI-colored green/red/blue strings

Generated with Devin