🚑 Restore portable eval imports on Bun and Node

[taras]

Why

CI on main is red because the RV10e value-root regression cannot load its authored effection import under Node or Bun. Node's generated module has no fixture dependency graph, while Bun's data-URI loader loses the generated module export when an import resolves to a filesystem-backed package.

Refs #647.

What changes

Before:

The Node test stopped at Cannot find module 'effection'. Bun stopped at expected default export to be a generator function, got string. Neither runtime reached the return-selection security assertion.

After:

The fixture exposes the prepared workspace dependencies as its project dependencies, and Bun compiles eval blocks through temporary TypeScript files. Deno, Node, and Bun all reach the intended missing-return refusal.

How it works

Bun entrypoint → temp-file compiler → host module resolution → eval generator
CLI fixture → explicit node_modules link → authored import → RV10e refusal

Review guide

Start with: packages/cli/tests/value-root.test.ts

Then review:

1. The Bun compiler selection in packages/cli/src/bun.ts
2. The compiler contract in specs/executable-mdx-spec.md
3. The aligned data-URI compiler description

Look carefully at:

• The generated eval file remains compilation-owned and is removed before compilation settles.

What must stay true

• Eval imports resolve through the host's module resolution — enforced by the runtime-named compiler and checked by the cross-runtime RV10e CLI test.
• A document cannot select its own return through the former named context — checked by RV10e reaching the missing-return diagnostic with empty stdout.

How to verify it

• deno task test packages/cli/tests/value-root.test.ts proves Deno keeps the existing data-URI behavior.
• pnpm exec tsx --test packages/cli/tests/value-root.test.ts proves Node resolves the authored import from the fixture project.
• bun test packages/cli/tests/value-root.test.ts proves Bun preserves the generated eval module and reaches the security assertion.

Scope

Included

• Bun eval-compiler selection
• The value-root fixture's dependency layout
• The compiler contract documentation

Intentionally unchanged

• Deno and compiled-binary data-URI compilation
• Return-flow ownership and settlement

Risks and limitations

• Bun now creates the same short-lived .xmd-eval file Node already creates; its ownership and cleanup contract are unchanged.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• Generated or mechanical changes are clearly identified.
• The description matches the final diff and test results.

[github-actions]

PR #649: 🚑 Restore portable eval imports on Bun and Node

4 files, +21 / -10

Scope

✅ PR scope looks good.

Structural

✅ No structural bloat detected.

Slop

✅ Slop indicators look low.

Static Analysis

Oxlint: 1 diagnostic across 1 file (1 rule)
Density: 0.048 violations/added-line

no-unassigned-import (1): packages/core/src/data-uri-compiler.ts

Correctness

FILE: packages/core/src/data-uri-compiler.ts
PATTERN: no-unassigned-import
CONCERN: Unused import from "effection"
QUESTION: Are ensure, scoped, and until required for data URI compilation logic?

FILE: packages/core/src/data-uri-compiler.ts
PATTERN: signal cluster
CONCERN: Single no-unassigned-import violation in a file with low density (0.048)
QUESTION: Is this a false positive or legitimate unassigned import?

No extraneous code patterns detected.

[taras]

The unassigned import is intentional and unchanged by this PR: @effectionx/converge is a static anchor for deno compile --exclude-unused-npm, as the adjacent comment explains. The named until import from effection is used by compileDataUri(). deno task lint passes locally and in CI, so no source change is needed for this review report.