[audit] Prune orphaned vim.pack plugins so removed entries stay removed

[stanfish06]

What

nvim-web-devicons was removed from nvim-pack-lock.json by #285 (merged), because mini.icons now mocks it and it's no longer in package_list. It reappeared in the lock file a few commits later (3a4f957→bbb40aa) and is back as of today.

Where

lua/config/plugins.lua:74-79 (the vim.pack branch of sync_packages())

Why it matters

vim.pack.add(package_list) only registers the plugins currently in package_list. It never deletes a plugin that drops out of the list — the on-disk clone (under the gitignored pack/ dir) just becomes "inactive". vim.pack.get() still reports it, and the subsequent vim.pack.update(nil, {...}) call re-syncs the lock file against everything vim.pack knows about, so the stale entry gets written straight back in. #285's fix could only ever last until the next sync — it edited the symptom (the lock file) rather than the cause (vim.pack never being told to drop the package).

This isn't specific to nvim-web-devicons: any plugin removed from package_list in the future will silently keep reappearing in the lock file the same way, since nothing ever calls vim.pack.del().

Fix

After vim.pack.add(package_list), find packages vim.pack.get() reports as not active (i.e. no longer in package_list) and vim.pack.del() them before vim.pack.update() runs:

local inactive = vim.iter(vim.pack.get())
    :filter(function(pkg) return not pkg.active end)
    :map(function(pkg) return pkg.spec.name end)
    :totable()
if #inactive > 0 then
    print("Prune orphaned: " .. table.concat(inactive, ", "))
    vim.pack.del(inactive)
end

Also removes the now-genuinely-stale nvim-web-devicons entry from nvim-pack-lock.json one more time — this time it should stick since the pruning step runs before the next auto-sync.

Mechanical, low-risk change scoped to the vim.pack sync path only; the legacy git-clone fallback path is untouched.

---

Generated by Claude Code