fix: isolate test globals, close tags at every caret, trim the runtime

Three pre-existing issues that the previous commit worked around rather
than solved.

Test global pollution. packages/csr's suites install a happy-dom window
over the real globals and delete them before each test. bun test runs one
file at a time, so those deletions outlived the file and later suites
failed with "fetch is not a function" -- 20 failures from `bun test` with
no argument. They now restore what they captured. The editor's Node tests
shim the vscode host by patching Module._load, which Bun's resolver does
not consult; the shim registers a virtual module under Bun instead, so the
same files pass under both runners.

Multi-cursor tag auto-close. The handler now closes the tag at every
caret. Positions come from the editor's selections rather than the change
ranges, which are in pre-edit coordinates and are short by the preceding
insertions once several carets share a line. One insertSnippet call
carries them all, since inserting sequentially would collapse the
selection to the first snippet. Carets wanting different closing tags are
declined rather than half-applied. Moved to its own module so it can be
tested without loading the language client.

Runtime size. Trimmed 2,414 bytes: the global lookup tables became one
prototype-safe scheme (a name like "toString" was previously a hit on
Object.prototype), shared hasOwn/toArray/pairBinding helpers replaced the
repeated chains, and dead code went. That was everything available without
dropping or deferring a feature -- 49,000 was not reachable, so the budget
is now 50,500, set just above the real figure so future growth trips it.

Two tests changed: one asserted on runtime source text and now asserts the
timers resolve; a new one covers reactive class bindings inside data-for,
which the enclosing loop effect tracks rather than each binding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/security-performance-audit.mjs

@@ -170,13 +170,18 @@ addCheck(
  */
 const runtimeBudgets = {
   /*
-   * Raised from 49,000 on 2026-08-19. The reactive runtime had already grown
-   * past the old figure, and client-side control blocks ({#if}/{#each}
-   * rerendering, for/while in handlers) added the rest. What a visitor pays is
-   * the compressed transfer: 52,570 minified is 16,803 gzipped, once, behind
-   * an immutable year-long cache.
+   * Raised from 49,000 on 2026-08-19, to just above what the runtime actually
+   * minifies to rather than to a round number with room to drift.
+   *
+   * The runtime was already over 49,000 before client-side control blocks and
+   * for/while support were added. Trimming it afterwards -- prototype-safe
+   * global lookup tables, shared hasOwn/toArray/pairBinding helpers, dead code
+   * -- recovered 2,414 bytes, which was everything available without dropping
+   * or deferring a feature. What a visitor pays is the compressed transfer:
+   * 50,156 minified is ~16,000 gzipped, once, behind an immutable year-long
+   * cache.
    */
-  "reactive-runtime.ts": 53_000,
+  "reactive-runtime.ts": 50_500,
   "component-controllers.ts": 24_100,
   "nav-runtime.ts": 12_000,
   "realtime-runtime.ts": 8_000,