fix: support Jest 28 CommonJS package imports (#2511)

## Problem

After #2507 fixes the CommonJS + browser-condition Jest failure, the
main-only examples job still has two CommonJS fixtures that fail under
Jest 28:

```
Cannot find module '#x509-transport-state'
```

Jest 28 does not resolve the package `imports` alias from the emitted
CommonJS modules.

## Fix

- Rewrite emitted CommonJS `require('#x509-transport-state')` calls to
relative `.js` state-module paths during package postprocessing.
- Keep the existing ESM rewrite and shared guarded X.509 state module
behavior unchanged.
- Add import-only tests for all four CommonJS ecosystem fixtures.
- Run those deterministic import checks in the credential-free ecosystem
runner so PR CI covers Jest 28 and Jest/jsdom without live API
credentials.

## Verification

Passed locally:

- `pnpm tsn ecosystem-tests/cli.ts node-ts4.5-jest28 --verbose
--retry=0` (failed before the fix, passed after)
- `pnpm tsn ecosystem-tests/cli.ts node-ts-cjs node-ts-cjs-web
node-ts-cjs-auto node-ts4.5-jest28 --verbose --parallel --jobs=4
--retry=0`
- `./scripts/test tests/ecosystem-cli.test.ts
tests/ecosystem-browser-credential-security.test.ts` (26 tests)
- `node --experimental-strip-types scripts/test-packed-package.ts`
- `pnpm lint`
- `pnpm exec tsc`

Also attempted the complete credential-free ecosystem matrix. All
relevant Node/CommonJS fixtures passed; the local run could not complete
Bun (binary unavailable), Deno (sandboxed cache permissions), or
browser-direct/webpack checks (Chrome launch unavailable). These are
local environment limitations, not failures in the changed paths.

Follow-up to #2507 and #2509.