fix: Block MDX compilation at Vercel runtime to protect release registry (#15953)

## Summary

This PR blocks MDX compilation from running at Vercel runtime, which was
causing:

1. **Registry overload**: Every runtime MDX compilation fetches from
`release-registry.services.sentry.io`, causing traffic spikes that
crashed the registry
2. **esbuild errors**: Runtime compilation fails with "read-only file
system" errors (DOCS-915, 4.9M+ events)

## Root Cause Analysis

When users hit URLs that don't exist (404s) or certain edge cases in
Next.js routing, the page component tries to render before falling back
to not-found. This triggers:

1. `getFileBySlugWithCache()` is called for a non-existent path
2. Cache check is skipped (only runs when `CI` env var is set)
3. MDX compilation is attempted via `bundleMDX()`
4. `remarkVariables` plugin fetches from release registry
5. esbuild tries to write to `/var/task/public/mdx-images` (read-only on
Lambda)
6. Error is thrown, registry has been hammered

## The Fix

Add a guard at the start of `getFileBySlug()` that throws immediately if
we're at Vercel runtime:

```typescript
const isVercelRuntime = process.env.VERCEL && !process.env.CI && process.env.NODE_ENV !== 'development';

if (isVercelRuntime) {
  throw new Error(`[MDX Runtime Error] Attempted to compile MDX at Vercel runtime for slug "${slug}"...`);
}
```

## Why This Is Safe

- All 9229 docs pages are statically generated during CI builds
(`force-static` + `generateStaticParams`)
- MDX compilation at runtime was **never intended** to work - the build
dependencies are excluded from the Lambda bundle
- This just makes the failure explicit and fast, protecting the registry
- Local development and CI builds are unaffected

## Fixes

- DOCS-915 (4.9M events)
- DOCS-9H5, DOCS-9N0, DOCS-9HB (related ENOENT errors)

---------

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Author: codyde

src/components/include.tsx

@@ -23,7 +23,8 @@ export async function Include({name}: Props) {
   try {
     doc = await getFileBySlugWithCache(`includes/${name}`);
   } catch (e) {
-    if (e.code === 'ENOENT') {
+    // Handle file not found (ENOENT) and runtime MDX compilation attempts gracefully
+    if (e.code === 'ENOENT' || e.code === 'MDX_RUNTIME_ERROR') {
       return null;
     }
     throw e;

src/mdx.ts

@@ -174,6 +174,22 @@ const isSupported = (
 let getDocsFrontMatterCache: Promise<FrontMatter[]> | undefined;
 
 export function getDocsFrontMatter(): Promise<FrontMatter[]> {
+  // Block filesystem scanning at Vercel runtime.
+  // Frontmatter should only be scanned during CI builds - the doc tree is pre-computed.
+  // See: DOCS-83Q, DOCS-9A5, DOCS-9RE
+  const isVercelRuntime =
+    process.env.VERCEL && !process.env.CI && process.env.NODE_ENV !== 'development';
+
+  if (isVercelRuntime) {
+    return Promise.reject(
+      new Error(
+        `[MDX Runtime Error] Attempted to scan docs frontmatter at Vercel runtime. ` +
+          `This should not happen - the doc tree should be pre-computed during CI. ` +
+          `If you're seeing this error, the requested path may not exist or was not included in generateStaticParams().`
+      )
+    );
+  }
+
   if (!getDocsFrontMatterCache) {
     getDocsFrontMatterCache = getDocsFrontMatterUncached();
   }
@@ -269,6 +285,22 @@ export async function getDevDocsFrontMatterUncached(): Promise<FrontMatter[]> {
 let getDevDocsFrontMatterCache: Promise<FrontMatter[]> | undefined;
 
 export function getDevDocsFrontMatter(): Promise<FrontMatter[]> {
+  // Block filesystem scanning at Vercel runtime.
+  // Frontmatter should only be scanned during CI builds - the doc tree is pre-computed.
+  // See: DOCS-83Q, DOCS-9A5, DOCS-9RE
+  const isVercelRuntime =
+    process.env.VERCEL && !process.env.CI && process.env.NODE_ENV !== 'development';
+
+  if (isVercelRuntime) {
+    return Promise.reject(
+      new Error(
+        `[MDX Runtime Error] Attempted to scan develop-docs frontmatter at Vercel runtime. ` +
+          `This should not happen - the doc tree should be pre-computed during CI. ` +
+          `If you're seeing this error, the requested path may not exist or was not included in generateStaticParams().`
+      )
+    );
+  }
+
   if (!getDevDocsFrontMatterCache) {
     getDevDocsFrontMatterCache = getDevDocsFrontMatterUncached();
   }
@@ -487,6 +519,30 @@ export const addVersionToFilePath = (filePath: string, version: string) => {
 };
 
 export async function getFileBySlug(slug: string): Promise<SlugFile> {
+  // Block MDX compilation at Vercel runtime.
+  // MDX should only be compiled during CI builds - all pages are statically generated.
+  // If this code path is hit at runtime, it means:
+  // 1. A 404 page is being accessed (Next.js tries to render before showing not-found)
+  // 2. Some edge case in routing is bypassing static generation
+  //
+  // Without this check, runtime MDX compilation would:
+  // - Fetch from release-registry.services.sentry.io (hammering the registry)
+  // - Fail with "read-only file system" errors from esbuild
+  //
+  // See: DOCS-915, DOCS-9H5, DOCS-9N0, DOCS-9HB
+  const isVercelRuntime =
+    process.env.VERCEL && !process.env.CI && process.env.NODE_ENV !== 'development';
+
+  if (isVercelRuntime) {
+    const error = new Error(
+      `[MDX Runtime Error] Attempted to compile MDX at Vercel runtime for slug "${slug}". ` +
+        `This should not happen - all pages should be pre-built during CI. ` +
+        `If you're seeing this error, the requested path may not exist or was not included in generateStaticParams().`
+    ) as Error & {code: string};
+    error.code = 'MDX_RUNTIME_ERROR';
+    throw error;
+  }
+
   // no versioning on a config file
   const configPath = path.join(root, slug.split(VERSION_INDICATOR)[0], 'config.yml');