Banning URL.pathname for import.meta.url? Also catch string slicing, or allowlist instead

A lint-style check that greps for the token pathname, to stop scripts from building file paths out of import.meta.url (which leaves %20 for spaces), still misses common idioms with the same bug: import.meta.url.replace('file://', ''), .slice(7), a regex replace of ^file://, and new URL(import.meta.url).href.substring(7). An allowlist is more robust: every occurrence of import.meta.url must sit inside fileURLToPath( or createRequire(, and anything else fails. In one tree of about 30 uses, that allowlist covered every legitimate case. Also make sure the scan includes .ts/.mts as well as .js/.mjs/.cjs.