H-5839: Bundle TypeScript into worker and remove CDN/polyfill workarounds

TypeScript now runs exclusively in the checker WebWorker, so:
- Move `typescript` from main bundle externals into worker bundle
- Add process/isNodeLikeSystem replacements to eliminate Node.js code paths
- Remove Node.js polyfill fallbacks from next.config.js (fs, path, os, etc.)
- Remove CDN CSP exceptions since Monaco is loaded locally

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: kube

apps/hash-frontend/next.config.js

@@ -216,20 +216,6 @@ export default withSentryConfig(
         // eslint-disable-next-line no-param-reassign
         webpackConfig.resolve.alias.canvas = false;
 
-        if (!isServer) {
-          // Stub Node.js built-ins for browser — needed by `typescript` (used by
-          // @hashintel/petrinaut's in-browser language service)
-          // eslint-disable-next-line no-param-reassign
-          webpackConfig.resolve.fallback = {
-            ...webpackConfig.resolve.fallback,
-            module: false,
-            fs: false,
-            path: false,
-            os: false,
-            perf_hooks: false,
-          };
-        }
-
         webpackConfig.plugins.push(
           new DefinePlugin({
             __SENTRY_DEBUG__: false,

apps/hash-frontend/src/lib/csp.ts

@@ -24,17 +24,13 @@ export const buildCspHeader = (nonce: string): string => {
       "https://apis.google.com",
       // Vercel toolbar / live preview widget
       "https://vercel.live",
-      // Monaco Editor loaded from CDN by @monaco-editor/react (used by petrinaut)
-      "https://cdn.jsdelivr.net",
     ],
 
     "style-src": [
       "'self'",
       // Required for Emotion/MUI CSS-in-JS inline style injection.
       // @todo Use nonce-based approach via Emotion's cache `nonce` option.
       "'unsafe-inline'",
-      // Monaco Editor stylesheet loaded from CDN by @monaco-editor/react (used by petrinaut)
-      "https://cdn.jsdelivr.net",
     ],
 
     "img-src": [
@@ -49,11 +45,7 @@ export const buildCspHeader = (nonce: string): string => {
       ...(process.env.NODE_ENV === "development" ? ["http:"] : []),
     ],
 
-    "font-src": [
-      "'self'",
-      // Monaco Editor CSS embeds the Codicon icon font as an inline base64 data URI
-      "data:",
-    ],
+    "font-src": ["'self'"],
 
     "connect-src": [
       "'self'",

libs/@hashintel/petrinaut/vite.config.ts

@@ -21,7 +21,6 @@ export default defineConfig({
         "react",
         "react-dom",
         "reactflow",
-        "typescript",
         "monaco-editor",
         "@babel/standalone",
       ],
@@ -48,7 +47,17 @@ export default defineConfig({
         // This causes crashes in Web Workers, since `window` is not defined there.
         // To prevent this, we do this resolution on our side.
         "typeof window": '"undefined"',
+        // TypeScript's internals reference process, process.versions.pnp, etc.
+        "typeof process": "'undefined'",
+        "typeof process.versions.pnp": "'undefined'",
       }),
+      // Separate replacePlugin for call-expression replacements:
+      // 1. Empty end delimiter because \b can't match after `)` (non-word → non-word).
+      // 2. Negative lookbehind skips the function definition (`function isNodeLikeSystem`).
+      replacePlugin(
+        { "isNodeLikeSystem()": "false" },
+        { delimiters: ["(?<!function )\\b", ""] },
+      ),
     ],
   },
 
@@ -59,6 +68,7 @@ export default defineConfig({
         "react/compiler-runtime",
         "react/jsx-runtime",
         "react/jsx-dev-runtime",
+        "typescript",
       ],
     }),