mainmatter
ember-simple-auth is using its own copies of peer-deps like RSVP
rsvp should be a peer-dep for ember-simple-auth but isn't. I'm not sure if that fix alone would cause ember-auto-import to stop bundling a unique rsvp version for use by it in its chunk but it may? There's probably something to work out with ember-auto-import here too.
Additionally: I am unsure what all embroider addon tooling is supposed to auto populate for externals, but either rsvp isn't in it and should be or ember-simple-auth needs to explicitly declare rsvp and similar as part of externals.
ember-auto-import should be treating rsvp like the rest of the magically-provided ember packages. So if it's getting bundled that's a bug in ember-auto-import (or @embroider/shared-internals).
Whereas if rsvp gets added to the package.json (as a peer or dependency), that would opt out of the magical backward compatible behavior and cause you to get a real copy, at least under embroider (would need to check under ember-auto-import).
Area to investigate https://github.com/embroider-build/ember-auto-import/blob/cccb8b1a5033272f32d65a00fdf33e1c05b8698d/packages/ember-auto-import/ts/webpack.ts#L358