[Core] Boot-time Node spawn residual for Pro+Rspack+RSC apps (deferred from #4340/#4355)

[justin808]

Summary

Residual from #4340/#4355: the boot-time RSC/Rspack version check still spawns a Node subprocess on every Rails boot for Pro+Rspack+RSC apps in a common configuration, even though the crash and the fail-open behavior were fixed.

Evidence

#4355 fixed the boot crash and static-parses the declared spec first, but detected_rspack_version_for_rsc (react_on_rails/lib/react_on_rails/version_checker.rb ~L265-279) still runs Open3.capture3("node", ...) on every boot when a flat node_modules/@rspack/core/package.json exists (common in dev and unpruned deploys), plus a narrow double-spawn path when Node resolution yields an unusable version. Both were raised and consciously deferred in the #4355 review (2026-07-02T07:51Z, 08:19Z).

Options (from the #4340 recommendation, not adopted)

• Restrict the Node probe to development/test environments (production web hosts rendering via a remote node-renderer often have no local Node anyway).
• Cache the resolved version per boot / memoize so at most one spawn occurs.

Acceptance criteria

• Healthy Pro+Rspack+RSC boots do not spawn Node in production (or spawn at most once, cached), with correctness preserved in doctor/generator paths.

Risk notes

Correctness is unaffected today; this is a ~50-150ms-per-boot cost plus an avoidable dependency on Node being on PATH at boot. Keep doctor/generator fail-closed.

Audit ledger: #4010 (comment)

Post-merge audit follow-up (fix-wave a6c5867..ed5049f). Filed by Claude Code on behalf of Justin Gordon.