#37338 node:module: build require.cache without user-writable globals and propagate its exceptions

Found by fuzzing. Both the release and the debug build abort on current main (f2fe7d3249).

Cross-check of the two earlier approaches (debug build):

The fallible initializer is the necessary part: with it alone, a tampered global turns the abort into a thrown error. Passing the intrinsics is a cheap hardening: with it alone, the stack overflow case still aborts because the builtin call still sits inside a LazyProperty initializer. The PR carries both. The earlier test that expected a TypeError for a clobbered Proxy is replaced by #40285's test, which expects require.cache to work.

ESM path. node:module is a lazy native module. The _cache export is read through SyntheticModuleRecord::materializeLazyExport, which propagates an exception from the property callback: a named import of _cache fails to link with the error, a read of ns._cache throws it, and the binding stays unmaterialized so the next read retries. Checked import("node:module") and export { _cache } from "node:module" with Proxy and Symbol set to undefined: both resolve to the same object as require.cache.

Termination. LazyProperty::callFunc wrapped the initializer in DeferTerminationForAWhile. The new accessor does not need it: a termination exception raised inside the builtin propagates like any other exception.

Tests. require.cache does not depend on user-writable globals deletes Proxy and sets Map and Symbol to undefined, then reads require.cache and Module._cache and checks the null prototype, the identity of the two, the [eval] entry and the Bun.inspect output. require.cache first accessed near the stack limit throws, and the next access builds it recurses to the stack limit, probes require.cache in the deepest catch block and Module._cache one frame up, and records both outcomes. Both probes must throw RangeError. The access at normal depth must then return the real cache: null prototype, identical to Module._cache, lists the [eval] entry, and an entry written through it is what require() returns. A stand-in object installed on failure (the #31079 shape) fails the last two checks. 20 of 20 runs pass on the debug ASAN build. Both tests fail on the released binary (the child aborts with exit 134 and empty stdout).

Runs. The repros above, the Module._cache variant of the stack limit repro and the ESM cases under BUN_JSC_validateExceptionChecks=1 BUN_JSC_dumpSimulatedThrows=1: no reports. node-module-module.test.js (49 pass, 1 skip), require-extensions.test.ts (10 pass), esm-registry-concurrent-gc.test.ts, module-children-concurrent-gc.test.ts, test/js/node/test/parallel/test-require-cache.js, and the non-leak test in test/cli/run/require-cache.test.ts.

Scope. The review of this diff pointed out that require.cache is one of several LazyProperty slots whose initializer runs JS and so can throw: m_utilInspectFunction and m_utilInspectStylizeColorFunction (#39382), m_processEnvObject on Windows (#38821), m_lazyTestModuleObject (caches an empty object on failure), ImportMetaObject::requireProperty and JSMockFunction::mock. Two changes would fix the class at once instead of one slot per PR. First, an early return from LazyProperty::callFunc in the JSC fork when the initializer leaves an exception pending, the way the fork already treats PropertyCallback builders. That needs a WebKit PR and a pin bump, and every slot then keeps its initLater lambda with a RETURN_IF_EXCEPTION inside. Second, a $Proxy private global for src/js, in the shape of $Buffer: macro(Proxy) in BunBuiltinNames.h, one install on the global object, and "Proxy" in globalsToPrefix in src/codegen/replacements.ts. That is Bun-only, but the prefix rewrites every Proxy reference in src/js (15 files, including node:http2 and node:test), so it is a change of its own. This PR stays a local fix for the slot with the deterministic repro. If the fork change lands, the accessor here collapses back into the initLater lambda and the two caller-side checks and the tests stay as they are.

History. Supersedes #31079, which installed an empty object as require.cache when the builtin threw. That leaves the cache broken for the rest of the process after a transient failure. Folds in #40285 (same fuzzer finding, intrinsics passed as arguments). The util.inspect lazy initializer in ZigGlobalObject.cpp has the same shape and aborts when Symbol is replaced and an object with an inspect.custom method is logged. That is tracked in #39382 and not changed here.