feat(node-smol-builder): implement VM-based bootstrap loader for async support

Replace static patch with dynamic template-based generation to support async
bootstrap code. The bootstrap previously failed when loaded via synchronous
require() but contained async code (main().catch()).

Changes:
- Add VM-based loader template using Module.wrap() + vm.runInThisContext()
- Implement dynamic patch generation with base64 bootstrap embedding
- Split 1.6MB base64 into 80-char chunks for git patch compatibility
- Calculate hunk headers dynamically (21,579 lines after expansion)
- Remove importModuleDynamically to avoid early ESM loader dependency

The generated patch embeds the entire bootstrap (1.2MB) as base64, decoded
at runtime. This approach matches Node.js's --require mechanism and properly
handles async code execution in the background.

Binary now executes correctly without dumping source to stderr.

Author: jdalton

packages/node-smol-builder/patches/load-socketsecurity-bootstrap-v24-preexec.patch

@@ -0,0 +1,74 @@
+# @node-versions: v24.10.0+
+# @description: Load Socket security bootstrap using Module.wrap() + VM (supports async!)
+#
+# This approach uses the same mechanism as `--require` modules, which properly handles async code:
+# 1. Module.wrap() creates proper module context (exports, require, module, __filename, __dirname)
+# 2. vm.runInThisContext() compiles and executes the wrapped code
+# 3. Async code can run in the background while Node.js continues initialization
+#
+# The bootstrap code is embedded as base64 and decoded at runtime (no filesystem dependency).
+
+--- a/lib/internal/process/pre_execution.js
++++ b/lib/internal/process/pre_execution.js
+@@ -673,6 +673,53 @@ function runEmbedderPreload() {
+   internalBinding('mksnapshot').runEmbedderPreload(process, require);
+ }
+
+ function loadPreloadModules() {
++  // Load Socket security bootstrap using Module.wrap() + VM approach.
++  // This allows async code in the bootstrap (unlike direct require()).
++  (function loadSocketBootstrap() {
++    // Bootstrap code embedded as base64 (build system replaces this placeholder).
++    // Split across multiple lines to avoid git patch line length limits.
++    const SOCKET_BOOTSTRAP_B64 = (
++      SOCKET_BOOTSTRAP_BASE64_PLACEHOLDER
++    );
++
++    try {
++      const Module = require('internal/modules/cjs/loader').Module;
++      const vm = require('vm');
++      const { Buffer } = require('buffer');
++
++      // Decode bootstrap from base64.
++      const bootstrapCode = Buffer.from(SOCKET_BOOTSTRAP_B64, 'base64').toString('utf8');
++
++      // Create dummy module (same approach as Module._preloadModules).
++      const bootstrapModule = new Module('socket:bootstrap', null);
++      bootstrapModule.filename = 'socket:bootstrap';
++      bootstrapModule.paths = [];
++
++      // Wrap code with proper module wrapper.
++      // This adds: (function (exports, require, module, __filename, __dirname) { ... })
++      const wrapped = Module.wrap(bootstrapCode);
++
++      // Compile using VM (this supports async code execution!).
++      const compiledWrapper = vm.runInThisContext(wrapped, {
++        filename: 'socket:bootstrap',
++        lineOffset: 0,
++        displayErrors: true,
++      });
++
++      // Execute with module context.
++      const exports = {};
++      bootstrapModule.exports = exports;
++
++      // Call the wrapped function with proper context.
++      // If bootstrap contains async code (main().catch(...)), it starts executing
++      // but returns immediately - async operations run in background.
++      compiledWrapper.call(
++        exports,
++        exports,
++        require,
++        bootstrapModule,
++        'socket:bootstrap',
++        ''
++      );
++    } catch (err) {
++      // Use stderr.write to avoid console dependencies during early bootstrap.
++      process.stderr.write(`Socket bootstrap error: ${err.message}\n${err.stack}\n`);
++    }
++  })();
++
+  // For user code, we preload modules if `-r` is passed
+  const preloadModules = getOptionValue('--require');
+  if (preloadModules && preloadModules.length > 0) {