fix(module): ask Node whether a specifier is a builtin

The first CI run failed on `node:test`, in every test file, reported as the
module boundary being broken. It was not: `builtinModules` omits `test` on
Node 20 (CI) and includes it on Node 24 (local), so a list rebuilt from it
disagrees with itself across versions.

Use `isBuiltin`, which is Node's own answer, and treat the `node:` prefix as
sufficient on its own -- a prefixed specifier can never resolve to a package,
whatever the running version enumerates. Test covers both forms.

Also corrects this file's header: the client half's guard is no longer
`external` (it never worked), it is the Vite build's resolution-time check plus
checkExternals.js on the built chunk.

Co-Authored-By: Claude <noreply@anthropic.com>

server/test/checkImports.test.js

@@ -81,6 +81,19 @@ test('allows node builtins anywhere, with or without the node: prefix', () => {
   )
 })
 
+test('allows node:test, which older Node versions omit from builtinModules', () => {
+  // The first CI run failed on exactly this and on nothing else: `builtinModules`
+  // omits `test` on Node 20 and includes it on Node 24, so every test file in
+  // this suite was reported as breaking the module boundary. The check asks
+  // Node (`isBuiltin`) rather than rebuilding the list, and treats the `node:`
+  // prefix as sufficient on its own — a prefixed specifier can never resolve to
+  // a package, whatever the running version enumerates.
+  assert.deepStrictEqual(
+    scanFixture({ 'a.js': `require('node:test'); require('node:test/reporters')` }),
+    [],
+  )
+})
+
 test('catches ESM and dynamic forms, not only require()', () => {
   const found = scanFixture({
     'a.js': [`import db from '../../core/db.js'`, `const x = await import('../../core/other.js')`].join('\n'),