fix(web): omit importer integrity for the trusted resolver stub (#8693)

* fix(web): omit importer integrity for the trusted resolver stub

Import-map integrity that covers the selected importer was applied to REA's
replacement resolver script. Strip only those integrity entries from the
installed map so native resolution can proceed while preserving dependency
integrity and the caller-selected map identity.

Fixes #8544

* fix(web): keep __proto__ import-map integrity keys on a null prototype

src/browser/modules/NativeModuleResolver.ts

@@ -33,6 +33,7 @@ import type {
 } from "../../domain/webModuleTrace.js";
 import { webModuleResolutionSchema } from "../../domain/webModuleTrace.js";
 import { ProviderStartupDeadline } from "../../process/ProviderDeadline.js";
+import { importMapForTrustedResolver } from "./importMapForTrustedResolver.js";
 
 const OPERATION = "trace_web_module_imports";
 const TIMEOUT_MS = 20000;
@@ -367,7 +368,7 @@ const resolveInBrowser = async (
         await route.fulfill({
           status: 200,
           contentType: "text/html",
-          body: `<!doctype html>${input.importMap === null ? "" : `<base href="${htmlAttribute(new URL(input.importMap.baseUrl).href)}"><script type="importmap">${scriptJson(input.importMap.value)}</script>`}`,
+          body: `<!doctype html>${input.importMap === null ? "" : `<base href="${htmlAttribute(new URL(input.importMap.baseUrl).href)}"><script type="importmap">${scriptJson(importMapForTrustedResolver(input.importMap.value, importerUrl, input.importMap.baseUrl))}</script>`}`,
         });
       } else if (
         !stubSent &&