oven: auto-invalidate core bundle cache on ac-source rsync
Three infra hardening changes so the bundler can't get out of date:
1. Auto-invalidate `coreBundleCache` when `lib/disk.mjs` mtime is newer
than the cache build time. sync-source.sh rsyncs ac-source without
restarting the Node process, so the cache otherwise serves
stale-bundler output until /bundle-prewarm is hit (or the process
restarts). Stat'ing one hot file as a sentinel is cheap and catches
every push.
2. Wire `nocache=1` through /pack-html → createBundle/createJSPieceBundle
→ getCoreBundle(forceRefresh). The route was reading the flag but
never propagating it, so &nocache=1 only busted the HTTP layer, not
the in-memory cache. Keep flow already passes &rebake=1&nocache=1, so
end users get a fresh bake on demand.
3. Restore the missing `?` exclusion in the parenthesized-import path
regex (regression introduced after f8c0d717c). Matches the other three
regexes in rewriteImports — `[^'"]+` was silently swallowing query
strings into the path capture for `("./foo.mjs?v=1")` shapes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>