docs(transpile): record the shared "child node via process.execPath" invariant

Both of the extension's child-Node spawns follow one invariant - launch via
process.execPath, never a bare "node" PATH lookup the host may not satisfy - but only
esbuild's path (through ensureNodeOnPath) documented it. Name node-runtime.ts as the
invariant's home and cross-reference it from the sslc compiler's fork, so the two sites
cannot silently diverge and the next reader finds one explanation.

A literal shared launcher was considered and rejected as premature abstraction: we own
sslc's fork but not esbuild's internal spawn, and the two sites are structurally unalike
(a process manager vs a one-line PATH tweak), so only the invariant is unified, not code.

Comment-only; no behavior change.

Author: burner1024

server/src/sslc/ssl_compiler.ts

@@ -62,6 +62,11 @@ export async function ssl_compile(opts: {
 
     let p;
     try {
+        // fork() launches process.execPath - the extension host's own runtime - so, unlike
+        // esbuild's internal spawn("node"), the built-in compiler needs no PATH shim. Both of
+        // this extension's child-Node spawns follow one invariant: launch via process.execPath,
+        // never a bare "node" PATH lookup (esbuild reaches it via ensureNodeOnPath in
+        // transpilers/common/node-runtime.ts, which is the documented home of that invariant).
         p = fork(COMPILER_MODULE, cmdArgs, {
             execArgv: [], // Disable Node.js flags like --inspect
             cwd: opts.cwd,

transpilers/common/node-runtime.ts

@@ -10,6 +10,12 @@
  * rather than resolving "node". We cannot change esbuild's spawn, but we can make "node"
  * resolve to process.execPath by pointing PATH at it - applied ONLY when "node" is not
  * already resolvable, so a host that already has Node is left untouched (zero regression).
+ *
+ * Extension-wide invariant (this module is its documented home): every child Node process
+ * launches via process.execPath - the runtime already executing our code - never a bare
+ * "node" PATH lookup the host may not satisfy. sslc gets this from child_process.fork's
+ * default (server/src/sslc/ssl_compiler.ts); esbuild's dep-internal spawn gets it from
+ * ensureNodeOnPath below.
  */
 
 import * as fs from "fs";