fix(compile): AOT-promote trusted reachable JavaScript

[proggeramlug]

Summary

AOT-promote statically reachable JavaScript and CommonJS files when their owning package is permitted by the host trust policy, without requiring every package to also appear in perry.compilePackages.

Changes

• Decouple file-level AOT promotion from the eager whole-package compilePackages routing list.
• Continue routing packages excluded by an explicit allow policy to the V8-free refusal boundary.
• Add regressions covering wildcard trust, Node export-condition selection, importer-relative CommonJS traversal, and explicit denial.

Related issue

Fixes #8518

Test plan

• cargo build --release clean
• cargo test --workspace --exclude perry-ui-ios --exclude perry-ui-tvos --exclude perry-ui-watchos --exclude perry-ui-gtk4 --exclude perry-ui-android --exclude perry-ui-windows passes
• cargo fmt --check
• cargo test -p perry --bin perry (1,010 passed)
• Added #[test] regressions in the affected crate
• (if CLI / stdlib / runtime API changed) Updated docs/src/ (not applicable)
• (if touching a platform UI backend) Built -p perry-ui-<backend> locally (not applicable)

Clippy with -D warnings is currently blocked by pre-existing warnings in unchanged files; neither clippy run reported a warning in the changed files.

Screenshots / output

Not applicable; this changes compiler routing behavior and is covered by regression tests.

Checklist

• I have NOT bumped the workspace version or edited CLAUDE.md / CHANGELOG.md (maintainer handles these at merge)
• My commits follow the loose feat: / fix: / docs: / chore: prefix convention used in the log
• I've read CONTRIBUTING.md and agree to the Code of Conduct

Summary by CodeRabbit

• Bug Fixes

  • Improved ahead-of-time compilation for trusted, statically reachable JavaScript and CommonJS dependencies.
  • Removed the need for per-package routing entries when wildcard compilation permission is enabled.
  • Untrusted packages continue to use runtime JavaScript modules.

• Documentation

  • Added release notes clarifying trusted dependency handling and compilation routing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c14c890e-ee99-47f1-a2fe-61bee941b40e

📥 Commits

Reviewing files that changed from the base of the PR and between 8d837df and 9f9af76.

📒 Files selected for processing (3)

• changelog.d/8529-aot-reachable-js.md
• crates/perry/src/commands/compile/collect_modules/discovery.rs
• crates/perry/src/commands/compile/collect_modules/tests.rs

Included review availability: Your plan provides up to 8 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The compiler now AOT-compiles statically reachable JavaScript and CommonJS files when package policy allows them. Tests cover trusted wildcard allowance and untrusted runtime routing. A changelog entry documents the behavior.

Changes

AOT promotion policy

Layer / File(s)	Summary
Update AOT promotion authorization crates/perry/src/commands/compile/collect_modules/discovery.rs, changelog.d/8529-aot-reachable-js.md	Allowlisted packages can promote statically resolved files without explicit compile_packages membership. The Node-addon exception remains unchanged.
Validate package routing crates/perry/src/commands/compile/collect_modules/tests.rs	Tests configure package policies and verify native compilation for trusted dependencies and runtime JavaScript routing for untrusted dependencies.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 9f9af

This PR changes compiler routing for trusted reachable JavaScript and adds targeted regression coverage; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (1 skipped: 1 unsupported.)	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description includes the required summary, changes, related issue, test plan, screenshots note, and checklist; it also identifies incomplete full-build and workspace-test checks.
Title check	✅ Passed	The title clearly and concisely describes the main compiler change: AOT promotion of trusted reachable JavaScript.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[proggeramlug]

Merging on green pr-gate for the current head, plus the mechanical pre-checks (stacks cleanly on main, no version-file changes, PR-keyed changelog fragment present).

Also included in a locally stacked build with #8525, #8529, #8531, #8533, #8534, #8536, #8537 to check cross-PR interaction — several of these touch the same files (expr_new/member.rs, collect_modules.rs, entries/part_1.rs), which per-PR CI does not exercise together.