feat: lint conditional require() gated on typeof window
Add ast-grep rules (no-typeof-window-require for .ts, -tsx for .tsx) that flag a
`require()` nested in a `typeof window` ternary or `if`. This pattern bundles the
server branch into the browser bundle; the fix is to split the module into a
`.ts` default and a `.browser.ts` variant, which the browser bundle is now
aliased to automatically (see generate-browser-variant-aliases.mjs).
Existing offenders are suppressed inline with a TODO to migrate; they are out of
scope for this change.