fix(runtime): emit the filesystem worker bundle as .mjs

[Astro-Han]

Summary

windows_sandbox_w0_protocol has failed on every main run since at least 2026-09-30. Two of the four tests in filesystem-worker-windows-smoke.test.js crash the worker at launch:

Error: Cannot read package config \\?\D:\a\maka\maka\package.json: operation not permitted.
code: 'ERR_INVALID_PACKAGE_CONFIG'  (node:internal/modules/run_main shouldUseESMLoader)

The worker bundle was emitted as dist/workers/filesystem-worker.js, so Node walks up to the nearest package.json to decide the module type. The AppContainer sandbox denies that read. Emitting the bundle as filesystem-worker.mjs makes it ESM by extension and removes the lookup.

FILESYSTEM_WORKER_BUNDLE_NAME stays the authority: the esbuild script and the desktop resource copy now import it from the runtime build instead of repeating the literal, so the producer cannot drift from the resolver. Packaging verifiers (verify-packaged-app, verify-macos-dmg, verify-windows-sandbox-e2e, windows-smoke, the release CLI packager and smoke) keep literal paths because they check the shipped layout on their own.

The same rename is part of #5969; this splits it out so W0 can go green without waiting for that feature.

Refs #5969

Verification

• npm --workspace @maka/runtime run build emits dist/workers/filesystem-worker.mjs; node apps/desktop/scripts/copy-runtime-filesystem-worker.mjs copies it to resources/workers/filesystem-worker.mjs.
• packages/runtime: node --test over filesystem-worker*, linux-sandbox*, macos-seatbelt* tests: 126 pass, 8 skipped (platform-gated), 0 fail.
• Scripts that read the touched files (ci-test-plan, ci-workflow-policy, desktop-release-targets, desktop-nightly, product-release, source-legal-inventory, verify-windows-harness, verify-packaged-app*, windows-package-source-closure, release-cli-*): 276/276 pass.
• npm run format, npm run lint: clean.
• W0 on Windows: see this PR's windows_sandbox_w0_protocol run.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code located the references, made the rename, ran the checks, and drafted this description.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No