feat(plugin-js): per-package ImportGraph cache, js_lint driver

[raphaelvigee]

M5 of the JS/TS heph plugin plan (part 5/6 of the stack).

Perf fix (prerequisite): deps_config, typecheck_config, and test_config each rebuilt the whole package's ImportGraph from scratch on every Provider::get call — for js_test, once per test file. Flagged independently by both the M2 and M4 reviews and deferred twice. Added a per-package memoized cache (keyed OnceCell behind a Mutex whose critical section is just the get-or-insert, so unrelated packages never serialize behind one lock) shared by all import-graph consumers, plus a call-count test proving it actually memoizes. Also added the equivalent cache for workspace-member discovery.

js_lint: cacheable per-package target, oxlint default + eslint (with type-aware parserOptions.project support) via a single linter config option. Reuses the lockfile-driven third-party resolution and tsconfig-extends-chain handling already established for js_typecheck/js_test.

Reviewed by feature-quality/code-quality/hermeticity — five BLOCKERs found and fixed: a fabricated package.json-config fallback that doesn't match how oxlint/eslint actually discover config; an unconditional hard-fail on packages with zero lintable source files; only the first parserOptions.project entry in a multi-entry eslint config being tracked; another real workspace escape — an unvalidated parserOptions.project path letting a repo-controlled eslint config make heph read and hash an arbitrary host file (e.g. /etc/hostname) with no workspace-containment check, now a hard error instead of a silent fallback; and eslint configs' own relative-path extends/imports going untracked.

Explicitly deferred: converging the several OnceCell-based caches onto the repo's hmemoizer primitive for panic containment across the ABI seam; a same-package concurrent-race test for the new cache; no bin-e2e coverage for any JS driver's dlopen/ABI-crossing seam yet.

Test plan

• cargo build -p plugin-js -p plugin-js-cdylib
• cargo test -p plugin-js
• cargo clippy -p plugin-js -p plugin-js-cdylib --all-targets -- -D warnings
• cargo fmt --check -p plugin-js -p plugin-js-cdylib

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[raphaelvigee]

Superseded by #370 — the whole stack was squash-collapsed into a single PR rebased on master, per request.