js_repl: canonicalize paths for node_modules boundary checks

[fjord-oai]

Summary

Fix js_repl package-resolution boundary checks for macOS temp directory path aliasing (/var vs /private/var).

Problem

js_repl verifies that resolved bare-package imports stay inside a configured node_modules root.
On macOS, temp directories are commonly exposed as /var/... but canonicalize to /private/var/....
Because the boundary check compared raw paths with path.relative(...), valid resolutions under temp dirs could be misclassified as escaping the allowed base, causing false Module not found errors.

Changes

• Add fs import in the JS kernel.
• Add canonicalizePath() using fs.realpathSync.native(...) (with safe fallback).
• Canonicalize both base and resolvedPath before running the node_modules containment check.

Impact

• Fixes false-negative boundary checks for valid package resolutions in macOS temp-dir scenarios.
• Keeps the existing security boundary behavior intact.
• Scope is limited to js_repl kernel module path validation logic.

git stack

• 👉 1 js_repl: canonicalize paths for node_modules boundary checks #12177
• ⏳ 2 Add feature-gated js_repl polling flow #10673