X_NODE_IMPORT_UNSCANNED

no source file was read, so every package reported zero

a glob that matches nothing makes the ratchet enforce nothing and reads exactly like a tree of pure Bun — which is why it is a finding rather than a pass

edit SOURCE_PATTERNS in scripts/boundaries.ts so it matches this repo layout, then bun run scripts/node-imports.ts