[X-Guardian]

Description

The repo already uses nx as its task runner for test, lint, and the affected-graph, but still depends on lerna for a handful of orchestration and release chores. This PR removes lerna entirely and routes those chores through nx, then converts the touched shell scripts to ESM Node.

Lerna → nx command mapping:

• lerna run --scope <glob> <target> → nx run-many -t <target> -p <glob> (root build, package*, watch, dist-clean scripts).
• lerna exec --scope <glob> -- <cmd> → nx exec -p <glob> -- <cmd> (link-packages, and the ncu runs in pnpm-upgrade.yml).
• lerna ls -p (absolute package paths) → pnpm --recursive exec pwd.
• lerna list --all --json / lerna ls --all --json (only the package names were used) → nx show projects --json.
• lerna version <v> → nx release version <v>. This needs a release block in nx.json (fixed release group of cdktn, cdktn-cli, @cdktn/*); the command is run with --git-commit/tag/push=false --stage-changes=false so it only rewrites versions on disk, matching the old --no-git-tag-version --no-push behaviour.

Other Changes

Dead code deleted rather than converted (both were unreferenced — nothing in the repo or CI invoked them):

• tools/build-unit-test-matrix.sh — the unit workflows build their matrix inline via nx show projects --affected; this script was orphaned.
• tools/setup-prebuild-provider-folder.sh — a manual utility that scaffolded a workspace of cloned hashicorp/* provider repos, which are no longer the canonical source.

Shell/batch scripts converted to ESM Node (.mjs), per the repo's preference for JS ESM tooling:

• tools/align-version.sh → tools/align-version.mjs. Also drops a dead jq loop that rewrote 0.0.0 peerDependencies — the only internal peerDep is cdktn: workspace:*, which jsii-pacmak resolves to a concrete version at pack time (verified against the built tarball), so the loop matched nothing.
• tools/collect-dist.sh and tools/collect-dist.bat → a single cross-platform tools/collect-dist.mjs (uses fs.cpSync(..., { dereference: true }) for the rsync -aL behaviour; verified byte-identical output to the old script). The .bat was still calling lerna ls -p, so this also removes the last stray lerna reference. package-windows now runs the same .mjs as every other platform.
• tools/build-example.js → tools/build-example.mjs (CJS require/__dirname → ESM). This leaves no CommonJS in top-level tools/.

Lint coverage for tools/: the root eslint.config.mjs ignores all **/*.js and **/*.mjs, and ESLint flat config does not auto-discover nested config files — so the top-level tools/ scripts were never linted (per-project linting only works because nx invokes ESLint per project). Added tools/project.json (@tools/scripts) so nx infers a lint target and the scripts are picked up by nx run-many -t lint, plus tools/eslint.config.mjs that lints them as plain ESM JavaScript (no type-aware TS parsing) and defers to the nested tools/* projects for their own files.

Callers updated: release.yml, unit.yml, pr-unit.yml, examples.yml, pnpm-upgrade.yml, CONTRIBUTING.md, and docs/release-please.md. Stale !tools/*.js negations in .gitignore / .prettierignore are dropped (the .mjs replacements aren't caught by the *.js ignore, so they need no negation).

Checklist

• I have updated the PR title to match CDKTN's style guide
• I have run the linter on my code locally
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation if applicable
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works if applicable
• New and existing unit tests pass locally with my changes

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days. This helps our maintainers find and focus on the active issues. If you've found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.