fix(web): name the four Node builtins the browser bundle now destructures

The Docker leg failed on `vite build`, and this one is genuinely this
branch's. @nodetool-ai/runtime now depends on @nodetool-ai/storage, which
drags @openclaw/fs-safe into the browser graph; it destructures readSync and
closeSync from node:fs, and the stub that replaces node:fs in the web bundle
did not export them. Two more surfaced behind the first: createHmac from
node:crypto, and request plus createRequire from the shared empty stub that
covers node:http, node:https and node:module.

A named import binds at bundle time, so empty.js's default Proxy cannot
satisfy one — every name a workspace bundle destructures needs a real export.
Each addition keeps the file's existing shape: throw on use, because
browser-tagged code must never reach these.

Also adds mkdtemp to the fs-promises stub. It was not an error, only an
IMPORT_IS_UNDEFINED warning from claude-agent-provider.ts, but the binding
resolved to undefined rather than to a named error.

Enumerated the missing exports from the build rather than fixing them one
crash at a time, and proved the check catches this: removing readSync alone
puts the build back to "not exported by fs-stub.js".

web build: exit 0, no MISSING_EXPORT, no IMPORT_IS_UNDEFINED.
npm run lint: 0 errors.

No test covered this. `npm run build` for web is not in the four mandatory
post-change checks, and only the Docker leg runs it on a PR.

Author: claude

web/vite-node-stubs/crypto-stub.js

@@ -15,10 +15,14 @@ export function createHash() {
   throw new Error("node:crypto.createHash not available in browser");
 }
 
+export function createHmac() {
+  throw new Error("node:crypto.createHmac not available in browser");
+}
+
 export function randomBytes(n) {
   const buf = new Uint8Array(n);
   globalThis.crypto.getRandomValues(buf);
   return buf;
 }
 
-export default { randomUUID, createHash, randomBytes };
+export default { randomUUID, createHash, createHmac, randomBytes };

web/vite-node-stubs/empty.js

@@ -10,3 +10,15 @@ const handler = {
   }
 };
 export default new Proxy({}, handler);
+
+// A named import binds at bundle time and the Proxy above cannot satisfy it,
+// so every named import a workspace bundle destructures from one of these
+// builtins needs a real export here. `request` is `node:http`/`node:https`.
+export function request() {
+  throw new Error("Browser stub: node:http.request not supported");
+}
+
+/** `node:module`. A bundle that reaches for CJS resolution has no browser path. */
+export function createRequire() {
+  throw new Error("Browser stub: node:module.createRequire not supported");
+}

web/vite-node-stubs/fs-promises-stub.js

@@ -29,6 +29,7 @@ export const readlink = makeThrower("readlink");
 export const utimes = makeThrower("utimes");
 export const truncate = makeThrower("truncate");
 export const rmdir = makeThrower("rmdir");
+export const mkdtemp = makeThrower("mkdtemp");
 
 export default {
   readFile,
@@ -49,5 +50,6 @@ export default {
   readlink,
   utimes,
   truncate,
-  rmdir
+  rmdir,
+  mkdtemp
 };

web/vite-node-stubs/fs-stub.js

@@ -18,6 +18,8 @@ export const accessSync = notInBrowser("accessSync");
 export const writeFileSync = notInBrowser("writeFileSync");
 export const openSync = notInBrowser("openSync");
 export const writeSync = notInBrowser("writeSync");
+export const readSync = notInBrowser("readSync");
+export const closeSync = notInBrowser("closeSync");
 export const createReadStream = notInBrowser("createReadStream");
 export const createWriteStream = notInBrowser("createWriteStream");
 export const cpSync = notInBrowser("cpSync");
@@ -58,6 +60,8 @@ export default {
   writeFileSync,
   openSync,
   writeSync,
+  readSync,
+  closeSync,
   createReadStream,
   createWriteStream,
   cpSync,