Bumps `vm2` from `^3.10.3` to `^3.11.5` via `pnpm install vm2@latest`.

- Updated version specifier in `package.json`
- Regenerated `pnpm-lock.yaml`

> **Note:** vm2 has been deprecated and archived upstream. A future
migration to `isolated-vm` or another sandboxing solution should be
considered.

Co-authored-by: copilot-swe-agent[bot] <[email protected]>

## Problem

Since 0.38.2, an ESM build can replace a runtime
`createRequire(...)` binding with `undefined`, causing the later runtime
`require(...)` call to throw.

## Change

- Disable Webpack's `createRequire` parser handling in ncc so Node
evaluates
  the call at runtime.
- Add a normal integration fixture with an `.mjs` entry that imports the
  TypeScript runtime payload and loads a runtime-selected JSON module.

This keeps the fix at ncc's Webpack configuration boundary and covers
the
reported runtime behavior without changing dependency tracing.

## Validation

- `node scripts/build.js --no-cache`
- `node --expose-gc --max_old_space_size=4096
node_modules/jest/bin/jest.js test/integration.test.js --runInBand
--testNamePattern create-require-runtime`
  - 1 passed
- `pnpm test -- test/unit.test.js`
  - 28 passed
- `node --expose-gc --max_old_space_size=4096
node_modules/jest/bin/jest.js --runInBand test/integration.test.js
--testNamePattern='^(?!should execute "ncc run
(?:axios\.js|canvas\.js|isomorphic-unfetch\.js|request-ts\.ts|request\.js|sharp\.js|socket\.io\.js)"$).*'`
  - 62 passed; 7 local environment-dependent cases skipped
- Negative control with Webpack's `createRequire` parsing restored
reproduced
  `TypeError: input_require is not a function`.

## Risk

The parser option applies to all JavaScript handled by ncc. It
intentionally
preserves `createRequire` for Node to evaluate at runtime, so modules
selected
only at runtime must still be deployed with the bundle.

The cross-platform Node 22/24/26 matrix remains for CI. A local CLI
watch test
failed with Watchpack `EMFILE` errors and reproduced identically on
`origin/main`, so it is not attributed to this change.

## Out of scope

- Changing how ncc traces or deploys runtime-selected modules.
- Dependency or lockfile updates.

## Issue linkage

Fixes #1312