fix: defer CJS transformation to the _compile patch in the async load hook - #45

…n integration (#22146)

Adds `koaChannelIntegration` in `@sentry/server-utils` for injecting
orchestrion channels into `koa`.

A subscriber wraps each registered layer in a span-creating proxy.
Span-helpers are ported from the vendored instrumentation, preserving
span names (but adapting to [new
conventions](getsentry/sentry-conventions#472)).

Also upgraded `@apm-js-collab/tracing-hooks` to get this:
apm-js-collab/tracing-hooks#45 to be released
(lets us actually patch `koa` - see 1. iteration below).



<details>
<summary>1. iteration</summary>

One thing to know for review: **we instrument `koa-compose`, not `use`
from koa.** koa's `use` lives in koa's main entry
(`lib/application.js`), and transforming a package's main entry forces
its top-level `require` chain through Node's `require(esm)` bridge,
which throws on Node < 24.13.

1. Orchestrion instruments by rewriting a module's source at load time
(via the ESM load hook).
2. `use` lives in koa's main entry (`lib/application.js`), so to
instrument it we transform that file. But transforming a main entry
pulls its whole top-level `require` chain into the loader's handling -->
and that changes how those `require`s are loaded (through the
ESM→CommonJS translator, not the normal sync require path).
3. `koa` is CJS (but support ESM). When `import`ing koa, it loads a shim
that loads the CJS code: `import 'koa'` → `dist/koa.mjs` (a ESM shim) →
`import '../lib/application.js'` (CJS). That CJS entry has a top-level
`require('is-generator-function')`.
4. `is-generator-function` → `require('generator-function')`, and
`generator-function` points at an `.mjs` file, which in turn imports
`./index.js`.
--> So the top-level `require` in koa's `application.js` (CJS) becomes
`require(esm)` of an ESM file importing a CJS file.
5. On Node < 24.13 (we pin 20.19.5), the loader can't pre-link this
dual-package shape into the `require(esm)` cache, so it throws `request
for './index.js' is not in cache`.

The failing chain:
```
koa/lib/application.js (CJS)
  └─ require('is-generator-function')        (CJS)
       └─ require('generator-function')      → require(esm) → require.mjs (ESM)
            └─ import './index.js'            (ESM importing CJS)
```

`koa-compose` is koa's zero-dependency dispatch engine, so it's safe to
transform, and `compose(app.middleware)` sees the same layers `use`
would. Since `@koa/router` also calls `compose` per request, the
subscriber uses `getActiveSpan()` to only wrap at app startup (no active
span) and skip the per-request router composition.</details>





Closes #20758

Linear:
https://linear.app/getsentry/issue/JS-2409/rewrite-opentelemetryinstrumentation-koa-to-orchestrion