fix: preserve runtime createRequire in ESM builds

[Jaksenc]

Problem

Since 0.38.2, an ESM build can replace a runtime
createRequire(...) binding with undefined, causing the later runtime
require(...) call to throw.

Change

• Disable Webpack's createRequire parser handling in ncc so Node evaluates
  the call at runtime.
• Add a TypeScript ESM integration fixture that loads a runtime-selected JSON
  module and executes the emitted .mjs bundle.

This keeps the fix at ncc's Webpack configuration boundary and covers the
reported runtime behavior without changing dependency tracing.

Validation

• node scripts/build.js --no-cache
• node --expose-gc --max_old_space_size=4096 node_modules/jest/bin/jest.js --runInBand -t 'should preserve runtime createRequire in ESM builds' test/integration.test.js
  • 1 passed
• pnpm test -- test/unit.test.js
  • 28 passed
• node --expose-gc --max_old_space_size=4096 node_modules/jest/bin/jest.js --runInBand test/integration.test.js --testNamePattern='^(?!should execute "ncc run (?:canvas|sharp|socket\.io)\.js"$).*'
  • 67 passed; 3 local environment-dependent cases skipped
• Negative control with Webpack's createRequire parsing restored reproduced
  the emitted undefined binding and runtime TypeError.

Risk

The parser option applies to all JavaScript handled by ncc. It intentionally
preserves createRequire for Node to evaluate at runtime, so modules selected
only at runtime must still be deployed with the bundle.

The cross-platform Node 22/24/26 matrix remains for CI. A local CLI watch test
failed with Watchpack EMFILE errors and reproduced identically on
origin/main, so it is not attributed to this change.

Out of scope

• Changing how ncc traces or deploys runtime-selected modules.
• Dependency or lockfile updates.

Issue linkage

Fixes #1312

[styfle]

Did you add the programatic api here instead of cli because you want to set esm: true?

If thats the only reason, its probably best to rename the .ts file to .mts or set type:module in package.json instead.