fix: self-contained built bundles + wire-size value cap (bot review)

Two findings from the GitHub review bot on the ready PR:

The tsdown two-entry build emitted the shared bootstrap module as a
lib/bootstrap-*.js chunk imported by both bundles, which the package.json
files whitelist (deliberately exact) omitted — a packed install had
dangling imports. The package now runs two single-entry builds, so each
bundle inlines its own bootstrap copy and every shipped file is
self-contained.

prepareValue admitted any cloneable value whose BOUNDED inspect rendering
fit maxValueBytes, so a huge container with a compact rendering (a
50k-element array renders as '... N more items') crossed the port raw,
bypassing the cap on both sides. The cap now measures the value's real
cross-boundary size — exact bytes for strings, the structured-clone wire
size (v8.serialize) for everything else — and oversized containers cross
as their bounded rendering instead.

packages/code-runtime/code-runtime-worker/tests/bootstrap.spec.ts

@@ -108,6 +108,16 @@ describe('prepareValue', () => {
     const { value } = prepareValue('x'.repeat(50), 10)
     expect(value).toBe(`${'x'.repeat(10)}… [truncated]`)
   })
+
+  it('measures a container by its structured-clone wire size, not its bounded rendering', () => {
+    // The bounded inspect rendering of a huge array is tiny ("... N more
+    // items"), but its real cross-boundary size is not — the cap must catch
+    // it, replacing the value with that bounded rendering.
+    const huge = new Array(50_000).fill(7)
+    const { value } = prepareValue(huge, 1_000)
+    expect(typeof value).toBe('string')
+    expect(value).toContain('more items')
+  })
 })
 
 describe('makeNamespaces', () => {

packages/code-runtime/code-runtime-worker/tests/runtime.spec.ts

@@ -221,6 +221,14 @@ describe('WorkerCodeRuntime — budgets and containment (real workers)', () => {
     expect(result.value).toBe(`${'y'.repeat(64)}… [truncated]`)
   })
 
+  it('caps a huge container whose bounded rendering is small (wire size, not rendering, is what counts)', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({ program: 'return new Array(50_000).fill(7)', bindings: [] })
+    expect(result.error).toBeUndefined()
+    expect(typeof result.value).toBe('string')
+    expect(result.value).toContain('more items')
+  })
+
   it('captures pipe writes that bypass the patched write slot as stray logs, capped by the same budget', async () => {
     const { runtime } = await setup({ maxLogBytes: 4 })
     const result = await runtime.run({