AB6005: also refuse bare createRequire/require/import.meta.resolve loads in compiled modules #591

Follow-up from the #588 self-review (reviewer finding 1, dismissed for that PR as out of scope).

AB6005 (packages/agent-bundle/src/build/validate-artifact-modules.ts, module-imports.ts) walks the ES-module import graph: static imports, literal dynamic import(), and import.meta. It does not read require("pkg"), createRequire(import.meta.url)("pkg") (or a bound loader), require.resolve, or import.meta.resolve("pkg") with a bare non-built-in specifier. Rspack leaves those calls in the emitted bundle, so a compiled module — in a host pack or, since #588, in the package build's dist — can still load a package from the consumer's node_modules through one of them without an AB6005 finding. The prepack gate (pack-dependencies.ts) already reads exactly those forms as AB7014 evidence, so the two gates agree today (such a package must be declared under dependencies), but the artifact is not fully self-contained in the sense the "Generated plugin output" rule intends.

Confirmed on #588's tree: es-module-lexer reports only node:module and import.meta for const load = createRequire(import.meta.url); load("left-pad") and for import.meta.resolve("right-pad").

Proposed: teach the AB6005 walk the same literal require / createRequire / import.meta.resolve semantics pack-dependencies.ts already implements (move the scanner to a leaf module both import — config/conventional-entry.ts pattern — do not copy it), applied to compiled modules only (prebuilt payloads stay opaque), with a relative target resolved inside the tree and a bare non-built-in reported as AB6005. This changes host-pack validation too, so it needs its own decision and changeset (pre-1.0 minor), fixtures for literal and computed require, createRequire (direct and bound, aliased), and import.meta.resolve, and a check that no generated code (cli-bins.ts, entry-shell.ts, install bins) uses these forms for a bare package today.

Docs to update with it: AGENTS.md "Generated plugin output", docs/diagnostics.md (AB60xx, AB7014 evidence paragraph), website/docs/{en,zh}/guide/distribution/validation.mdx, the AB7014 recovery string in pack-inventory.ts.