A bundled actions/setup/js/*.cjs script previously shipped with await inside a non-async helper, causing a hard SyntaxError at require() time and breaking runtime log parsing steps. This change moves detection of that failure class into the standard lint gate so invalid bundled CommonJS syntax is rejected before lock files ship.

• Make lint-cjs syntax-aware

  • Wire make lint-cjs to run the existing eslint-factory lint over actions/setup/js.
  • Keep the current formatting checks, but add real parsing/linting so invalid CommonJS syntax fails during validation instead of at workflow runtime.
  • Bootstrap eslint-factory dependencies when needed so the gate works from a fresh clone.

• Add a focused regression test

  • Add an ESLint parser-level test that codifies the specific failure mode:
    • reject await inside a non-async function
    • allow the same code when the function is marked async

• Scope

  • No workflow logic changes.
  • No new lint framework introduced; this uses the existing eslint-factory path that already targets bundled setup scripts.

const messages = linter.verify(
  `function writeStepSummaryWithTokenUsage(coreObj) { await coreObj.summary.write(); }`,
  cjsConfig,
  "parse_mcp_gateway_log.cjs"
);

expect(messages).toContainEqual(
  expect.objectContaining({ fatal: true, ruleId: null })
);