…injection is honored (#21339)

## Summary

Fixes the root cause behind #19147. On **Next.js 16 / Turbopack
production builds** (e.g. Vercel), `modulesIntegration` returns no
injected modules, which silently disables every module-detection-based
auto integration — `vercelAIIntegration`, `openAIIntegration`,
`anthropicAIIntegration`, `googleGenAIIntegration`,
`langChainIntegration`, `langGraphIntegration` — and leaves
`event.modules` missing server dependencies. The result users see: raw
`ai.*` spans (`op: default`) instead of `gen_ai.*`.

## Root cause

`packages/node-core/src/integrations/modules.ts` captured the injected
value into a **module-level `const` at evaluation time**:

```ts
const SERVER_MODULES = typeof __SENTRY_SERVER_MODULES__ === 'undefined' ? {} : __SENTRY_SERVER_MODULES__;
```

The two bundlers inject `__SENTRY_SERVER_MODULES__` differently:

- **webpack** replaces the bare token with a literal at build time via
`DefinePlugin` → available the moment this module evaluates. ✅
- **Turbopack** (added in #19231) assigns
`globalThis.__SENTRY_SERVER_MODULES__` at **runtime**, via a
value-injection loader on `instrumentation.*`.

The catch: the `instrumentation.*` file's ESM `import`s are **hoisted
above** the injected assignment. Verified in a real Turbopack build
(`.next/server/chunks/[root-of-the-server]__*.js`):

```js
769449, e=>{ "use strict";
  var r = e.i(298962);                                  // import @sentry/* — evaluates modules.ts (SERVER_MODULES captured = {})
  async function s(){ await e.A(145684) }               // register()
  globalThis.__SENTRY_SERVER_MODULES__ = {/* …deps… */} // injection runs AFTER the import
}
```

So `@sentry/node-core/modules` evaluates **before** the global is
assigned, and the `const` is frozen as `{}`. The other two sources in
`collectModules()` also come up empty on a bundled server (no
full-dependency `package.json` at `process.cwd()`; `ai` is bundled so
it's not in `require.cache`, and the server is ESM not CJS). Net:
`getModules().ai` is `undefined` → `shouldForceIntegration` returns
`false` → `addVercelAiProcessors` never attaches.

## Why #19231 didn't catch it

#19231 was unit-tested at the config-generation layer (asserting the
value-injection rule is emitted). The `nextjs-16` AI E2E that asserts
`gen_ai.*` spans passes for the wrong reason — it runs `next start`
**locally**, where `getModulesFromPackageJson()` reads
`process.cwd()/package.json` (present, lists `ai`) and masks the broken
`SERVER_MODULES` path. On Vercel that fallback is empty, so detection
fails.

## Fix

Read the value **lazily** (per call) instead of capturing it at
module-eval time, and support both injection styles:

```ts
function getServerModules(): Record<string, string> {
  if (typeof __SENTRY_SERVER_MODULES__ !== 'undefined') return __SENTRY_SERVER_MODULES__; // webpack
  return (GLOBAL_OBJ as ...).__SENTRY_SERVER_MODULES__ ?? {};                              // turbopack
}
```

By the time `getModules()` is first called (during integration
`afterAllSetup`, i.e. after `register()` → `Sentry.init()`), the
instrumentation module body has fully executed and the global is set.
webpack is unaffected (token still replaced).

## Regression test

`packages/node-core/test/integrations/modules.test.ts` re-imports the
module with no global set (mirroring Turbopack), then assigns
`globalThis.__SENTRY_SERVER_MODULES__` **after** import and asserts
`getModules()` reflects it. This **fails on the previous code** and
passes with the fix.

## Blast radius

Low. webpack path unchanged; Turbopack now honored; `event.modules`
restored on Turbopack. Re-enables all module-detection-based auto
integrations on Next.js 16 without requiring `vercelAIIntegration({
force: true })`.

## Follow-up (separate)

The existing `nextjs-16` AI E2E should be hardened so it can't pass via
the `process.cwd()` package.json fallback — e.g. a `--turbopack` build
variant run from a working directory whose `package.json` does not list
the AI SDK, asserting `gen_ai.*` spans still appear. Happy to do this in
a follow-up.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>