fix(cli): checkup reads only the import header

[oxura]

Fixes #1501.

--checkup scanned every trimmed line of the source. A legal multiline String body containing import ./missing.bend as Missing therefore caused an independent filesystem lookup and failed an otherwise valid aggregation; import-looking text naming a real IO module could also select a module outside the import header.

Follow the existing normal loader's header rule: skip blank/comment lines, and stop at the first non-import line. The aliased-import selector and independent module checking/running remain unchanged. No parser or bend2/bend.ts changes.

Added a consumer regression in gates/ping.ts: the aggregation first passes ordinary --check-only, then its real imported sum must independently return 5n without treating a multiline body string as an additional import. The exact assertion fails against unchanged upstream (--checkup exits 1 with ENOENT) and passes against the compiled, installed-layout CLI (--checkup exits 0 and returns 5n).

Verification:

• bun gates/repo.ts: 54 / 54.
• Built an actual installed-layout executable with bun build --compile and an adjacent bend2 installation.
• 18 actual source/installed CLI executions: multiline body missing/real/IO import-looking text, interleaved blank/comment header lines, multiple header imports, CRLF, absolute imports, a bad header module followed by a good one, no aliased header imports, and ordinary checker/runner controls.
• The bad real header import still makes the command fail while the later good header import still returns 5n; hidden body IO is not run.

The full private-site-dependent gates/ping.ts installation suite was not run here; its newly added assertion was executed directly with the real before/after CLIs. GUIDE.md, CHANGELOG.md, and protected human source were not changed.