vfs-bundle: guards where the disk is read, os/cpu/libc target, early option checks - #197

buildGitHubBundle and suggestedEntries check their options against an
empty Vfs, before anything is fetched: "what the tree is never decides
them" (#197). #178's directoryEntryError then found every extensionless
entry missing from that empty tree. So `src` with pnpm was refused as "no
such file or directory" rather than "only JS bundles are built with pnpm",
and main's "buildGitHubBundle reads nothing from disk" test fails.

The pre-fetch checks now pass `fetched: false`, which skips the
missing-entry errors. buildVfsBundle still checks entries against the
project's own tree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01C6oBS5QX4oqZcd2d3STiGA

…uote; green main after #178 (#201)

* fix(vfs-bundle): check entries before the fetch without looking for them

buildGitHubBundle and suggestedEntries check their options against an
empty Vfs, before anything is fetched: "what the tree is never decides
them" (#197). #178's directoryEntryError then found every extensionless
entry missing from that empty tree. So `src` with pnpm was refused as "no
such file or directory" rather than "only JS bundles are built with pnpm",
and main's "buildGitHubBundle reads nothing from disk" test fails.

The pre-fetch checks now pass `fetched: false`, which skips the
missing-entry errors. buildVfsBundle still checks entries against the
project's own tree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01C6oBS5QX4oqZcd2d3STiGA

* fix(bundle): a package.json that's there but can't be read is refused, as Node refuses it

host.stat returns null for any failure, as Node's module lookup does. So
every package.json reader took a link loop, or a file behind a directory
that may not be searched, for no package.json and walked past it:

- the strict Solidity reader, which bucketed a forge lib's files as the
  project's own;
- the resolver the Vfs host uses, and the Vfs host's findPackageJSON;
- State's walk up to a bucket's name, and its root discovery;
- readModuleManifest.

Node refuses such a package.json with ERR_INVALID_PACKAGE_CONFIG, and
counts only "nothing there" as none, a link to nothing included. Real stat
tells the two apart and host.stat doesn't. That's right for the module and
lib probes, which treat any failure as absent as Node and Rust do, so stat
stays as it is. When a package.json reader's stat fails, a read now says
why:

- statStrict, for configs and the strict package.json read, names the file
  from the project root (`lib/dep/package.json: can't be read (ELOOP)`).
  readRegularFileOrNull uses it too, instead of rethrowing the raw fs
  error with its absolute path.
- packageJSONStat throws Node's ERR_INVALID_PACKAGE_CONFIG, for the
  resolver, the Vfs host's findPackageJSON and State.

Lenient lookups (Bash, Rust, `stasis add`, --package-json) still walk
past a malformed or unreadable one. A differential against Node's
require.resolve and findPackageJSON now agrees on every case: missing,
dangling, a directory, malformed, a self-loop, a loop through
directories, and (unprivileged) a link into an unsearchable directory.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01C6oBS5QX4oqZcd2d3STiGA

* fix(bundle): invalid-remapping errors name the entry, never its text

An invalid remapping's error quoted it. The text is normally a remapping
the project wrote, but a file named as a mapping by mistake can hold
anything: `--mapping=token.txt` printed `token.txt:1: invalid remapping
"ghp_…"` to stderr, and into CI logs with it. A token pasted into
FOUNDRY_REMAPPINGS did the same.

Errors now give the location and the form the entry should have:
`remappings.txt:2: invalid remapping, expected [context:]prefix=target`.
A foundry.toml entry is named by its position (`` `remappings` entry 2 ``,
`` `remappings` entry 1 is not a string ``). This is the last error of
stasis's own that quoted file content.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01C6oBS5QX4oqZcd2d3STiGA

---------

Co-authored-by: Claude <[email protected]>