Port secret-gated MongoDB TLS corpus registration

Bun corpus slice

• Position 4036: js/third_party/mongodb/mongodb.test.ts

Gap

The upstream integration is guarded by TLS_MONGODB_DATABASE_URL, but Home rejects its harness/mongodb ESM imports before the guard can register the skipped test.

Acceptance criteria

• rewrite the harness and MongoDB imports through the bootstrap module registry
• preserve the upstream secret gate as one todo/skipped integration when credentials are absent
• expose a deterministic MongoClient surface for bootstrap diagnostics
• attempted unsupported connections fail with a structured, credential-safe MongoDB error carrying operation, sanitized endpoint, original cause, and stack context
• add conditional registration and error behavior to permanent coverage

Implemented and pushed in 640fb16 (feat(third-party): port MongoDB corpus registration).

What landed:

• rewrote the harness and mongodb imports through Home's bootstrap module registry
• preserved the upstream TLS_MONGODB_DATABASE_URL gate as one skipped/todo integration when the secret is absent
• added a deterministic MongoClient surface whose unsupported connection path returns MongoServerSelectionError with ERR_MONGODB_CONNECT, operation=mongodb.connect, sanitized endpoint, original cause, and a caused-by stack
• permanently verifies that credentials never appear in the public message or stack
• opened #285 for the real native TLS transport and CRUD integration; this slice does not pretend the live connector is complete

Verification:

• position 4036: 0 failed, 0 unsupported, 1 upstream todo
• positions 4035–4036: 4 passed, 1 todo, 0 failed/unsupported
• permanent third-party error diagnostics: 21 passed
• full always-on third-party mini-suite: passed

This advances the contiguous full-corpus boundary through position 4036: 378 files, 3,425 passed, 230 todo, 0 failed, 0 unsupported (172 allowlisted empty files).