module: centralize builtin exposure policies

[sjungwon03]

Builtin exposure rules are currently split between realm.js and
separate setup functions in pre_execution.js for each option-gated
builtin.

Move the JavaScript loader's scheme and option-gating policies into one
table, and let pre-execution apply them after option initialization.

This intentionally keeps the policy in the JavaScript loader instead of
deriving it from native option registration. Native options do not
describe which builtins they expose: one option may enable multiple
builtins, while other options are unrelated to builtin exposure.
Code-cache categorization also has a separate responsibility. Adding
exposure metadata there would duplicate loader policy across the native
and JavaScript boundaries.

The policy test validates every declared builtin ID and option, as well
as defaults, --no-experimental-*, NODE_OPTIONS, and command-line
precedence. It also covers CommonJS, ESM, Workers, child processes, and
process.getBuiltinModule().

A builtin omitted entirely from the policy table cannot be detected
automatically because there is no independent native mapping between
options and builtins. Centralizing the loader-owned policy reduces that
risk without introducing a second source of truth in C++.

Refs: #65418
Refs: #65964
Refs: #65920
Refs: #65840

Tests:

• make -C out -j4 node
• python3 tools/test.py -j4 parallel/test-module-builtin-policies parallel/test-module-builtin-experimental parallel/test-sqlite

[nodejs-github-bot]

Review requested:

• @nodejs/loaders
• @nodejs/startup

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.37%. Comparing base (96ee81c) to head (59a764c).
⚠️ Report is 29 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66292      +/-   ##
==========================================
+ Coverage   90.35%   90.37%   +0.01%     
==========================================
  Files         790      790              
  Lines      273814   274472     +658     
  Branches    52382    52565     +183     
==========================================
+ Hits       247409   248056     +647     
+ Misses      16906    16887      -19     
- Partials     9499     9529      +30     

Files with missing lines	Coverage Δ
lib/internal/bootstrap/realm.js	97.09% <100.00%> (+0.10%)	⬆️
lib/internal/process/pre_execution.js	96.76% <100.00%> (+0.09%)	⬆️
lib/internal/test/binding.js	89.74% <100.00%> (+1.86%)	⬆️

... and 68 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[daeyeon]

This list could become stale as policies change. For example, if these modules no longer need experimental flags while other modules still do, the test could pass without the coverage described above.

[sjungwon03]

Thank you for pointing this out. I removed the hard-coded workerPolicyIds list and updated the test to derive its Worker coverage from all available option-gated policies.

Policies that share the same option are now tested together, using both the positive and --no-* forms. This should keep the Worker coverage aligned automatically as the policies change.

I also verified that the builtin policy, experimental builtin, and SQLite tests all pass. Thank you for the helpful review.