feat(bundlers): Add orchestrion bundler plugins

[timfish]

There was already a Vite bundler plugin for orchestrion that included our instrumentations but this PR adds the ability to include additional instrumentations and adds plugins for other bundlers.

I left the Bun plugin out of @sentry/server-utils because there is already one in the Bun package and I can't see it being used anywhere else 🤷‍♂️

[sentry]

Bug: The Rollup plugin spreads the upstream plugin and then redefines the options hook, which will silently drop any logic from the original hook.
_{Severity: MEDIUM}

Suggested Fix

Instead of overwriting the options hook, the new implementation should call the original hook if it exists. A safer pattern would be to capture the original options hook before spreading, and then call it from within the new hook implementation to ensure both sets of logic are executed.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: packages/server-utils/src/orchestrion/bundler/vite.ts#L14-L18

Potential issue: In `rollup.ts`, the code creates a new Rollup plugin by spreading the
properties of the upstream `@apm-js-collab/code-transformer-bundler-plugins/rollup`
plugin and then defining a new `options` hook. This pattern overwrites the `options`
hook from the upstream plugin. If the upstream plugin has its own `options` hook for
configuration, which is a common pattern for bundler plugins, its logic will be silently
lost. This could lead to incorrect bundler behavior or misconfiguration, as the upstream
plugin's setup logic would not be executed.

Also affects:

• packages/server-utils/src/orchestrion/bundler/rollup.ts:18~24

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f9aaa97. Configure here.}

[cursor]

Webpack skips externals stripping

Medium Severity

The new webpack orchestrion plugin only forwards to the upstream transformer and never adjusts externals, unlike the Rollup, esbuild, and Vite wrappers. When instrumented packages stay external, webpack resolves them from node_modules at runtime and the transform never runs, so channel injection silently fails.

 

^{Reviewed by Cursor Bugbot for commit f9aaa97. Configure here.}

[cursor]

Double cast lacks explanation

Low Severity

The esbuild plugin uses an as unknown as { setup: ... } double cast without a comment explaining why safer typing is not possible. SDK review guidelines require a comment for each such cast.

 

^{Triggered by project rule: PR Review Guidelines for Cursor Bot}

^{Reviewed by Cursor Bugbot for commit f9aaa97. Configure here.}