test: load audit fixtures as modules and verify combined mobile payload

docs/audits/structured-hold-retention/README.md

@@ -6,7 +6,8 @@ Run from the repository root:
 ORCA_BACKGROUND_LAUNCH=1 node docs/audits/structured-hold-retention/reproduce.mjs
 ```
 
-The script bundles the actual `StructuredAgentSessionHolds` implementation in memory. It runs it
+The script bundles the actual `StructuredAgentSessionHolds` implementation into temporary CommonJS
+modules, loads them normally, and removes their files and module-cache entries. It runs the code
 once without the post-resume holder check and once with the current source. It uses a deferred
 provider acquisition, an isolated fake child, and a 5 ms release grace. It launches no application,
 provider, or terminal and reads no user profile.

docs/audits/structured-hold-retention/reproduce.mjs

@@ -1,6 +1,8 @@
 import { createHash } from 'node:crypto'
-import { readFile } from 'node:fs/promises'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { build } from 'esbuild'
 
@@ -46,13 +48,20 @@ async function loadHolds(withPostResumeCheck) {
       }
     ]
   })
-  const loaded = { exports: {} }
-  new Function('module', 'exports', 'require', result.outputFiles[0].text)(
-    loaded,
-    loaded.exports,
-    createRequire(import.meta.url)
-  )
-  return loaded.exports.StructuredAgentSessionHolds
+  const scratch = await mkdtemp(join(tmpdir(), 'orca-structured-hold-proof-'))
+  const require = createRequire(import.meta.url)
+  let moduleId
+  try {
+    const bundlePath = join(scratch, 'holds.cjs')
+    await writeFile(bundlePath, result.outputFiles[0].text)
+    moduleId = require.resolve(bundlePath)
+    return require(moduleId).StructuredAgentSessionHolds
+  } finally {
+    if (moduleId) {
+      delete require.cache[moduleId]
+    }
+    await rm(scratch, { recursive: true, force: true })
+  }
 }
 
 async function reproduce(Holds) {