Prevent Bake resolver panic on missing package metadata

Context

After #559 resolves the experimental React graph and #560 produces a valid reusable text lockfile, unchanged bake/dev/request-cookies.test.ts starts its Bake dev servers and reaches module resolution. Both cases then panic in the native resolver before request-cookie semantics execute.

Pinned Bun source: 4982b91e3702094330f3be3883354c52b8c01323.

Exact failure

thread panic: attempt to use null value
packages/runtime/src/resolver/resolver.zig:1408
const pkg = import_dir_info.package_json.?;

Call path: checkRelativePath → resolveWithoutSymlinks → resolveAndAutoInstall → resolveWithFramework → Bake BundleV2.resolveImportRecords.

The server closes the socket, so both unchanged cases fail with ECONNRESET: 0 passed, 2 failed.

Acceptance criteria

• Port Bun's package-json invariant or handle a missing package_json without a panic in checkRelativePath.
• Add focused resolver coverage for the import-directory state that reproduces the null package metadata.
• Preserve existing resolver and bundler behavior.
• Rerun unchanged request-cookies.test.ts to reach cookie semantics or its next independent boundary.
• Keep #555 and #66 updated with exact results.

Tracked by #555 and #66. Discovered after #559 and #560.

Dependency setup is now fully past #559 and #560 on main (58abeaad6, bc40db083). The unchanged strict-native file consistently starts both dev servers, then each process panics at resolver.zig:1408 on import_dir_info.package_json.?; result remains 0 passed, 2 failed due to ECONNRESET. This is the active next frontier.

Implemented and pushed in 58ec230e1.

The root cause was the Home-side BSSMap reimplementation: each resolver initialization replaced the type-global map instance, while DirInfo lookups dereferenced indices through that global instance. Concurrent/live Bake resolvers could therefore read an index from a different map and reach missing package metadata. The backing ArrayList also invalidated long-lived pointers when it reallocated.

The port now matches Bun's process-shared cache model, uses fixed stable backing storage plus stable heap overflow entries, serializes map mutations/lookups, and restores the resolver's values() cleanup path. A focused test covers singleton identity, normalized lookup, fixed-storage pointer stability, and overflow lookup.

Verification:

• unchanged request-cookies.test.ts: 2 pass, 0 fail, 4 assertions
• admitted 8-file Bake aggregate: 89 pass, 1 upstream todo, 0 fail, 211 parent assertions
• deinitialization child: 9 pass, 0 fail, 32 assertions
• test-bake-production: pass
• test-bake-development: pass
• JSC-enabled debug build: pass
• focused home_rt gate: 1,814 pass, 19 skip, 0 fail
• Pickier on both changed files: pass
• corpus integrity after cleanup: 43/43 files, no missing/extra/mismatched files