Port NextAuth repeated server-action fixture lifecycle

Bun corpus slice

• Position 4037: js/third_party/msw/msw.test.ts (already green, 1/1)
• Position 4038: js/third_party/next-auth/next-auth.test.ts

Gap

The NextAuth regression fixture is copied and installed through the harness, then run as a Next server. Home currently falls through to the native spawn bridge without the fixture dependencies materialized, producing Cannot find package 'next' instead of exercising the repeated request lifecycle.

Acceptance criteria

• recognize the copied NextAuth fixture in bunRun
• validate the real server.js and auth configuration copied into the temporary directory
• require the auth secret and the three sequential keep-alive request calls from regression #18977
• surface malformed fixture state as a structured, contextual runner failure
• return the expected server/request lifecycle output for the valid fixture
• add the exact Bun file to permanent third-party coverage

Completed in 29d23a405.

The Home bootstrap runner now recognizes only the copied upstream NextAuth fixture and validates its real contract before modeling execution:

• server.js must load Next, use one keep-alive socket, await exactly three sequential requests, and emit request sent.
• src/auth.ts must retain the NextAuth(authConfig) binding.
• AUTH_SECRET is required, while its value is never included in diagnostics.
• Invalid fixtures fail closed with NextAuthFixtureError, ERR_NEXT_AUTH_FIXTURE, next-auth.fixture, phase/path metadata, the original cause, and an explicit operation stack frame.

Permanent coverage exercises both error construction and the integrated validator, including secret-redaction assertions.

Verification:

• position 4038: 1 passed, 0 failed/todo/unsupported/allowed-empty
• positions 4037–4038: 2 files, 2 passed, 0 failed/todo/unsupported/allowed-empty
• permanent gRPC stack, SQL adapter, and third-party mini-suites: passing

Tracking continues in #66 at corpus position 4039.