fix(webpack-plugin): inject client runtime module in watch mode only

[joeldickson]

Problem

WebpackBuildStatsPlugin added the DevFeedback browser runtime (references window, WebSocket, MutationObserver, module.hot) to every initial chunk of every compilation — including one-off production/CI builds.

Real-world breakages from the 2.0.9 batch rollout:

• supply-layout CI (build-clientside-for-test): html-webpack-plugin compiles public/index.html in a child compilation; the injected runtime ends up in the compiled template which html-webpack-plugin then evaluates via node:vm → Error: window is not defined → build fails.
• SSR bundles (Agoda.SupplyLayout.SsrClientSide): the same runtime would be executed in Node on server startup → window is not defined crash.
• Acceptance-test browsers get a runtime that opens a WebSocket to localhost, which is meaningless outside local dev.

Fix

1. Only register the runtime-module injection when compiler.watchMode is true (webpack dev server / --watch) — the snippet exists to report HMR/DOM-update events during local development; it serves no purpose in one-off builds.
2. Defensive typeof window === 'undefined' || typeof document === 'undefined' early-return in the generated client code, so any future accidental evaluation outside a browser is a no-op instead of a crash.

Build-stats collection (compile/done hooks) is unaffected and still runs in all builds.

Tests

• Updated the hook-tapping spec: runtime injection now asserted for watch mode.
• Added spec asserting one-off builds get no runtime injection.
• All 6 specs pass.