fix(security): isolate async SSR render context

[smiggleworth]

Closes #131

Uses AsyncLocalStorage for async SSR context isolation and fails closed before request work when the runtime cannot provide it. Synchronous fallback rendering remains supported.

Verification:

• fallback context regressions: 3 passed
• npm run check: passed

[Copilot]

Pull request overview

This PR addresses the security finding in #131 by removing the module-global async fallback for SSR render context and instead requiring AsyncLocalStorage for async context isolation, failing closed when it isn’t available. This prevents concurrent SSR requests from leaking render context across awaits in environments without proper async context propagation.

Changes:

• Update withRenderContextAsync to throw immediately when AsyncLocalStorage-backed isolation is unavailable (no async fallback stack).
• Add a concurrent regression test ensuring async fallback contexts are rejected before request work begins.
• Refactor the SSR fallback-context test helper to better control a “no Node versions” runtime simulation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
tests/jsdom/ssr/fallback-context-invariants.test.ts	Adds a concurrency regression asserting async fallback fails closed and does not execute request work.
src/ssr/context.ts	Removes the unsafe module-global async fallback stack behavior by throwing when AsyncLocalStorage can’t be used.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.