fix(scripts): replace raw TLS guard matching with compiler AST

[code-yeongyu]

Summary

Fixes #3105. Replace the regex/hand-lexer raw TLS guard with ts.createSourceFile from the existing @typescript/typescript6@6.0.2 dependency. No runtime TLS policy changes or new Senpi dependencies.

Head: d8b1351. Main was integrated without rewriting history; behind 0 at verification.

Detection and pinning

• TLS/HTTPS/HTTP2 imports/requires in namespace, named/default-as, side-effect, dynamic/static-template, export-from and TypeScript import-equals forms; process.getBuiltinModule and clients reached through bindings/aliases.
• Conservative Bun.connect references, optional calls, destructuring declarations and assignments, aliases, call/apply. Regex and nested templates are handled by parser AST nodes.
• Parser failures throw with the scanned filename. Exact normalized AST node text plus occurrence count remains the allowlist key; acquisitions and calls are pinned independently, never exempted by file.
• Tracked shipped-source selection is unchanged. All four changed code files are below 250 pure LOC (maximum 224).

Measured RED -> GREEN

The OmOWright #41 Opus review (b515dc9d6a) supplied the independent harness.

Probe	Before	After at current tree
Original reviewer cases	23/45	43/45
H1 desync samples	4/4	4/4
Parser-confirmed sampled midfile injections	143611/143611	143509/143509

The precise OmOWright H1 blind region did not reproduce in Senpi; H2 and malformed-source fail-open did. The original 45 cases contain 43 positives and two intentional negatives (inbound Bun.listen, third-party ws); all positives are now caught. The site totals differ because the scanned tracked tree changed.

New regression tests first ran 7 pass / 14 fail; the remaining import-equals/Bun-assignment cases were also RED first (23 pass / 2 fail) before becoming GREEN.

Gates

• node --test scripts/no-raw-tls-client*.test.mjs: 38 pass / 0 fail, after integrating current main.
• tsc --noEmit and tsc --noEmit -p scripts/tsconfig.json: exit 0.
• Repository biome check --error-on-warnings .: exit 0, 5833 files. Explicit Biome lint over guard files also passes with no warnings/errors.
• git diff --check: exit 0; configured commit author retained without overrides.
• Evidence and executable adapted reviewer scripts held locally. Broader GitHub CI remains separate/running; no full local suites were requested or run.

Related: #3098, merged #3099, code-yeongyu/omowright#41 and code-yeongyu/oh-my-openagent#9893. No PR merge or Slack.