bundle-plugin: bundled @vscode/ripgrep shim resolves rgPath inside app.asar, breaking file search in packaged Electron apps

In @theia/bundle-plugin (observed in 1.73.1), the esbuild plugin replaces @vscode/ripgrep with a shim: export const rgPath = require("path").join(__dirname, './native/rg...'), copying the binary next to the bundle.

In an electron-builder packaged app, the bundle typically lives inside app.asar. Electron redirects require() of .node files to app.asar.unpacked, but does not redirect child_process.spawn. The shim drops the asar → asar.unpacked handling that @vscode/ripgrep itself performs, so rgPath points inside the archive and every spawn fails — ENOENT on Windows, ENOTDIR on macOS — and file search silently returns 0 results. The .node files in the same directory keep working (require is redirected), which makes this asymmetry hard to diagnose.

Suggested fix: emit the replacement in the shim, e.g. .replace(/\bapp\.asar([\\/])/, "app.asar.unpacked$1"), and/or document that packagers must add the copied native directory to asarUnpack.

Downstream report with full diagnosis and measurements: AkariLabs/akari-video#5 (our workaround: asarUnpack: lib/backend/native/** + a post-bundle patch restoring the replacement).

Related observation in the same plugin: @vscode/windows-ca-certs is hard-resolved on win32 (join(resolveModulePath(...), 'build/Release/crypt32.node')). When that optionalDependency is silently dropped by npm (e.g. MSVC Spectre libraries missing → MSB8040), the build fails much later with an opaque Could not resolve path of module error. Treating it as external-with-warning on win32 too would fail cleaner. Happy to split this into a separate issue if preferred.