fix(tools/prim): walk .ts/.mts, strip types before parse, suppress noise

Five fixes that turn `prim` from "reports zero on every TS source tree"
into a tool that actually works against socket-lib's own src/.

audit.mts:
- **Walk .ts/.mts/.cts/.tsx/.jsx (in addition to .js/.mjs/.cjs)**.
  Previously the walker only yielded .js/.mjs, so any TypeScript
  source tree audit returned zero findings.
- **Strip TypeScript types via `module.stripTypeScriptTypes` before
  parsing**. acorn-wasm's `typescript: true` doesn't cover modern TS
  syntax (`export type`, class fields with annotations, generic type
  parameters) — strip-then-parse is reliable and uses only Node
  built-ins. Suppresses the one-time `ExperimentalWarning` for this
  API since we rely on stable byte-offset behavior, not on any
  experimental detail.
- **Compute line/column from `node.start` byte offset** instead of
  `node.loc.start`. acorn-wasm in our build doesn't populate
  `node.loc` even with `locations: true` — every finding came back as
  `line:0 column:1`. Now we build a per-file line-starts table once
  and binary-search into it.
- **Skip the safe `Object.prototype.<method>.call(...)` idiom**. That
  pattern is already-correct hardening (the canonical safe way to
  call a prototype method on untrusted input); flagging it as a
  migration target is misleading.
- **Skip esbuild's CJS interop glue and helper-variable boilerplate**:
    Object.defineProperty(exports, "__esModule", ...)
    var __defProp = Object.defineProperty;
  Both are machine-generated bundler plumbing, not user code. Uses
  acorn-wasm's `walk` (ancestor-aware) instead of `simple` so we can
  detect `var __defProp = ...` assignments by walking up to the
  enclosing VariableDeclarator.

codemod.mts:
- **Restrict to .js/.mjs/.cjs/.jsx**. Rewriting TypeScript would
  require source-mapping between stripped-types and original byte
  offsets — out of scope. Keeping audit's TS support; codemod is
  honest about what it can rewrite. The README now documents this
  scope difference between audit and mod.

Verified against socket-lib itself: `prim coverage --target . --dir
src` now reports 26 sites across 16 distinct primordials with proper
file:line locations. `prim gaps` reports "surface complete — no gaps,"
which is the answer to "are we missing any primordials in src?"

Author: jdalton

tools/prim/README.md

@@ -77,7 +77,7 @@ pnpm prim mod --target . --dir src --include-guessed --apply
 | `prim gaps`     | Report call sites that need a primordial that doesn't exist yet — the input list for expanding `socket-lib/src/primordials.ts`. |
 | `prim audit`    | Run `coverage` + `gaps` and (optionally) persist the snapshot to the state file.                                                |
 | `prim state`    | Inspect the persisted state file.                                                                                               |
-| `prim mod`      | Codemod source files to use primordials. Dry-run by default; pass `--apply` to write.                                           |
+| `prim mod`      | Codemod **JavaScript** source files to use primordials. Dry-run by default; pass `--apply` to write. TypeScript is out of scope (rewriting `.ts` requires source-mapping between stripped-types and original byte offsets) — `prim audit` still walks TS, so candidates are visible.                                           |
 
 ## How it knows what's covered