Add Module Loader

[AaravMalani]

This pull request introduces a new pluginset to load Source Academy modules via Conductor plugins. It adds three new packages, @sourceacademy/common-module-loader, @sourceacademy/runner-module-loader, and @sourceacademy/web-module-loader. It also reverts the repository to Yarn PnP

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9179da3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

💥 An error occurred when fetching the changed packages and changesets in this PR

Some errors occurred when validating the changesets config:
The package or glob expression "@sourceacademy/web-stepper" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch

[gemini-code-assist]

Code Review

This pull request introduces a new Module Loader protocol and its implementation across three packages: a common package for shared types, a runner-side plugin to request and register modules, and a web-side plugin to fetch the module directory and serve module bundles. The feedback highlights critical improvements needed for protocol robustness and safety, including adding moduleName to response messages to prevent race conditions, handling potential promise rejections in asynchronous operations (such as dynamic imports and fetch requests), and securing the module name validation regex with anchors to prevent path traversal or input validation bypasses.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.