Support 9.1 runtime contract.

• import-map keys are matched literally, module responses must carry a JavaScript MIME, unresolvable specifiers fail loudly, and the client owns every URL shape it hands the loader. The dev boot already fits that contract - bundle.mjs is a local ES module whose static graph is only the query-free /ns/core bridge URLs, so the pre-configure window is harmless - and this makes the remaining edges explicit:
  • Serve the dev server with appType 'custom' so Vite's SPA fallback can never answer a module request with index.html; a bad module path now fails as a plain 404 that names the URL instead of a MIME rejection.
  • Set the module headers on /ns/entry, the one module route that sent no Content-Type.
  • Load the framework client strategy through an absolute URL resolved from import.meta.url. A ../ specifier from a dev-served module made the runtime register the strategy under a non-canonical .../hmr/client/../frameworks/... key and fetch its closure through blocking synchronous requests outside the async graph walk.
  • Type createRequire/createPumpingRequire on the ns:module surface and document the pre-configure invariant in the entry emitter