fix: reduce Windows 8.3-short-name detection false-positives

[harshmathurx]

Description

Fixes a Windows dev-server file allow-list false negative where a legitimate resolved file path containing ~ is rejected before safeModulePaths / server.fs.allow can be considered.

Root cause: the 8.3-short-name guard used filePath.includes('~'), which catches ordinary tilde-containing directories or filenames even though the security concern is specifically a Windows 8.3 alias segment such as PROGRA~1.

This PR narrows the guard to path segments that look like Windows 8.3 short-name aliases, while keeping the existing protections for true short-name-style paths.

Fixes #22892

Verification

Local checks run:

• pnpm --filter vite build
• pnpm run test-unit static

CI evidence on the PR is green for the relevant matrix, including:

• Build&Test: node-24.15.0, windows-latest
• Ubuntu/macOS Build&Test jobs
• Lint: node-24, ubuntu-latest
• Semantic Pull Request
• zizmor

Risk / compatibility

The change is Windows-specific and keeps rejecting segments that match the 8.3 alias shape. It only allows ordinary long-path names containing ~ to proceed to the existing safeModulePaths, deny-glob, and server.fs.allow checks.

Reviewer note

cc @sapphi-red since this follows up on the Windows alternate-path guard from #22572.

Additional context

AI assistance was used while preparing this patch; Harsh reviewed the diff and ran the checks listed above.

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Before submitting the PR, please make sure you do the following

• Read the Contributing Guidelines.
• Read the Pull Request Guidelines.
• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
• Provide related issue(s)/PR(s) if any.
• Provide a description of the changes in this PR.

Tests

• pnpm --filter vite build
• pnpm run test-unit static

[harshmathurx]

@sapphi-red I opened this as a narrow follow-up to the Windows alternate-path guard from #22572. It keeps rejecting 8.3-looking path segments such as PROGRA~1, but allows ordinary tilde-containing paths so safeModulePaths / server.fs.allow can work as intended.

[harshmathurx]

@sapphi-red gentle follow-up here. This is still a narrow Windows path guard adjustment: keep rejecting 8.3-looking segments like PROGRA~1, but allow legitimate tilde-containing paths that are explicitly permitted by the configured file allowlist. Happy to reshape if there’s a preferred invariant for this check.

[sapphi-red]

There would still be false-positives, but that should be fine.