test(cloudflare): Add Vite-build support to the integration-test runner

[JPeer264]

Teach the integration-test runner to support suites that opt into the Sentry Vite plugin. When a suite ships a vite.config.*, the runner runs vite build first (so the plugin's auto-instrumentation transform runs) and points wrangler dev at the generated dist/<worker>/wrangler.json, matched to the right source config via its userConfigPath. Suites without a Vite config keep running straight from source, unchanged (= wrangler).

No suite uses this path yet; the auto-instrument feature commits that follow add their own vite-autoinstrument/* integration suites.

[semgrep-code-getsentry]

High severity vulnerability may affect your project—review required:
Line 30374 lists a dependency (vite) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like /.env::$DATA?raw, or 8.3 short filenames), allowing an attacker to read otherwise-denied files when the dev server is exposed to the network.

References: GHSA, CVE

To resolve this comment:
Check if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows.

• If you're affected, upgrade this dependency to at least version 7.3.5 at yarn.lock.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[sentry]

Bug: The strict path comparison in builtFromSource() will likely fail because path.join() creates an OS-specific absolute path, while the Vite plugin may generate a relative or differently formatted path string.
_{Severity: MEDIUM}

Suggested Fix

Before comparing the paths in builtFromSource(), normalize them. Convert both built.userConfigPath and sourceConfigPath to a consistent format, such as absolute paths with normalized separators, using functions from the path module.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: dev-packages/cloudflare-integration-tests/runner.ts#L66-L73

Potential issue: The `builtFromSource()` function compares a generated config path
(`built.userConfigPath`) with a locally constructed path (`sourceConfigPath`) using
strict string equality (`===`). The `sourceConfigPath` is an absolute path created with
`path.join()`, which uses OS-native separators. The `userConfigPath`, generated by the
`@cloudflare/vite-plugin`, is likely to be a relative path or use a different separator
format (e.g., forward slashes). This mismatch will cause the comparison to fail,
preventing Vite-built test suites from being located and throwing an error. This issue
is particularly likely to manifest on Windows due to path separator differences.

_{Did we get this right? 👍 / 👎 to inform future reviews.}