fix: sandbox npm package store for devservers

[imanmalekian31]

Add an opt-in package_store_mode = "sandbox" mode to js_run_devserver.

By default, npm package symlinks in the custom devserver sandbox point back to the Bazel execroot. Bundlers that canonicalize paths using native realpath() and enforce a project-root boundary, such as Next.js with Turbopack, reject packages resolved outside the sandbox.

The new mode materializes the npm package store inside the sandbox and rewrites or dereferences node_modules symlinks so their real paths remain within the sandbox root.

Files are copied with COPYFILE_FICLONE, which uses a copy-on-write filesystem clone when supported and falls back to a regular copy. Both strategies keep devserver writes isolated from Bazel outputs. The sandbox parent directory can be configured with JS_RUN_DEVSERVER_SANDBOX_DIR; placing it on the same filesystem as the execroot increases the chance that copy-on-write cloning is available.

The existing behavior remains the default, so current users are unaffected unless they opt in.

Related: #2888

---

Changes are visible to end-users: yes

• Searched for relevant documentation and updated as needed: yes
• Breaking change (forces users to change their own code or config): no
• Suggested release notes appear below: yes

Suggested release notes

js_run_devserver now supports package_store_mode = "sandbox" for bundlers such as Turbopack that require resolved npm package paths to remain within the project root.

Test plan

• Added unit coverage for package-store path and sandbox symlink resolution.
• Added integration tests verifying that:
  • scoped and unscoped npm packages resolve inside the sandbox;
  • package-store directories are materialized rather than linked to the execroot;
  • no node_modules symlink, including .bin and package-internal links, escapes the sandbox;
  • granting sandbox write permissions does not modify execroot files;
  • a devserver that chmods and writes a package file without pre-granted write permissions cannot mutate the execroot file.
• Extended the js_run_devserver end-to-end test to exercise incremental syncing with package_store_mode = "sandbox".
• Verified JavaScript syntax, focused unit tests, and diff checks locally.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: faf2f6c5c0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[imanmalekian31]

Could you review my PR? @jbedard