fix(runtime): stub node:/bun: built-ins in dev module server (#2315)

[viniciusdacal]

Summary

• The dev module server now recognizes node:* and bun:* specifiers as runtime built-ins and returns empty ES module stubs instead of attempting to auto-install them from npm
• The import rewriter short-circuits these specifiers to avoid unnecessary filesystem resolution
• Stubs include console.warn() so developers know imports were stubbed for the browser
• Comment injection prevention via // line comments and specifier sanitization

Root Cause

When @vertz/db (or any server-side package) is transitively pulled into the client bundle, its top-level import { ... } from "node:fs/promises" gets rewritten to /@deps/node:fs/promises. The module server's handle_deps_request() had no check for built-in modules, so it:

1. Failed to find them in node_modules/
2. Attempted auto-install from npm registry
3. npm returned 404 → "Auto-install failed" error overlay

Changes

File	Change
native/vtz/src/server/module_server.rs	is_runtime_builtin() + runtime_builtin_stub() helpers, early return in handle_deps_request()
native/vtz/src/compiler/import_rewriter.rs	Early return for node:/bun: in rewrite_specifier_inner()

Public API Changes

None — internal runtime behavior only.

Test plan

• test_handle_deps_request_node_builtin_returns_stub — node:fs returns 200 with stub
• test_handle_deps_request_node_builtin_subpath_returns_stub — node:fs/promises returns 200
• test_handle_deps_request_bun_builtin_returns_stub — bun:sqlite returns 200 with console.warn + export default
• test_handle_deps_request_node_crypto_returns_stub — node:crypto returns 200
• test_handle_deps_request_node_module_returns_stub — node:module returns 200
• test_handle_deps_request_regular_package_still_404 — non-builtins still 404
• test_handle_deps_request_builtin_stub_no_comment_injection — crafted node:*/alert(1)// does not execute
• test_is_runtime_builtin_positive / test_is_runtime_builtin_negative — predicate unit tests
• Import rewriter tests for node:*, bun:*, subpaths, and full-code integration
• Rust quality gates: cargo test --all && cargo clippy --release -- -D warnings && cargo fmt --check

Closes #2315

🤖 Generated with Claude Code