fix(client): validate runtime imports and smoke the jac run quickstart

[marsninja]

Description

Bare jac run starts web apps with Vite/HMR. Annotation-only Jac imports such as Session and JacYacState could survive JavaScript lowering without matching runtime exports, causing development startup to fail. Pack smoke exercised production serving and missed that first-run failure.

• Remove Jac import bindings with no emitted runtime references while preserving module evaluation. Retain references from JSX and embedded JavaScript, record and validate remaining imports in the shared client compiler, and invalidate older cached artifacts. Native runtime assembly handles bare side-effect imports.
• Run the pack smoke browser journey through the exact bare jac run quickstart, check HMR startup and dependency-scan errors, then repeat the journey against a built .jab served outside the source project. Keep fleet coverage.
• Stop the hot reloader and Vite when the server exits, including normal shutdown.
• Emit Wasm and its import manifest beside the selected client bundle so app-specific and custom outputs reach sealed artifacts. Resolve sealed assets from the served module, and serve built entry HTML for root/client routes so production stylesheet links are preserved.
• Save type-check caches only after successful checks and skip restoring them on retries. Start a new cache namespace to discard entries saved by failed checks.

The CLI surface and existing --serve behavior remain unchanged.

Validation

• Added regressions for import retention/removal, missing exports, module evaluation, artifact cache compatibility, JSX/assertion references, shadowing, and native runtime dependencies.
• Added regressions for app-specific/custom Wasm outputs and sealed HTML, stylesheet, and Wasm serving from an unrelated runtime base. All eight HMR/Wasm tests and all five sealed-image tests passed locally, including the nested-project build.
• Focused import-contract and CLI compatibility tests: 19 passed. JavaScript-generation, SSO, and Solid tests also passed in CI.
• Full CI passed on c9124794e, including the overall check. Pack smoke passed all three browser journeys: bare jac run, the production artifact outside the source project, and fleet gateway serving. Compiler, client, runtime, scale, Kubernetes, bootstrap, and Android jobs passed.
• Workflow YAML parsing, smoke shell syntax, targeted formatting, and git diff --check passed.
• Full CI type check: 1,020 files passed with a fresh cache. The previous restored cache repeatedly produced 13 missing Pillow-member diagnostics in unchanged byLLM code; the cache change discarded those entries and provides a cold retry path.
• Local limitations: an existing asset test differs in macOS /var versus /private/var path spelling. The full local type check passed 1,017 files and failed three files that passed in CI. The commit hook was bypassed after existing ES backend diagnostics in files listed in .jacignore; relevant formatting and targeted checks were run directly.