[DO NOT MERGE] feat(core): add opt-in assertion instrumentation - #6592

Number(arg) in %d/%i/%f branches throws for Symbols and BigInts, crashing the assertion reporting path that is documented to never throw. Wrap these conversions in try-catch like the adjacent %j branch.

The hoisted var _Error = Error; alias at program top fails when a module declares a top-level let, const, or var named Error, causing a ReferenceError on load or a TypeError when the assertion fires.

Also found at:

• packages/core/src/js/tools/sentryBabelTransformerUtils.ts:5

The var _Error = Error injected at program top captures module-level Error bindings (e.g. an import { Error } or let/var Error), so new _Error() later throws TypeError instead of creating the intended assertion error.

Tests that pass siteId without jest.isolateModules permanently add entries to the shared module-level reportedSites set, making the suite order-dependent and brittle against future additions that reuse a call-site id.

The %d, %i, and %f format specifiers call Number(arg) without a try-catch, so a Symbol, BigInt, or object with a throwing valueOf crashes the reporting path instead of reporting safely.

Also found at:

• packages/core/src/js/assertion.ts:244
• packages/core/src/js/tools/sentryBabelTransformerUtils.ts:8
• packages/core/test/tools/sentryAssertionBabelPlugin.test.ts:51-54

collectValueIdentifiers can emit identifiers that are in the temporal dead zone; evaluating them on the failure path throws a ReferenceError instead of reporting the assertion cleanly.

The Babel plugin unconditionally replaces every matched CallExpression with condition || reportCall() via path.replaceWith(). Because the original assertion pragmas (invariant, assert, warning, console.assert) return undefined (falsy), the replacement alters the resulting value and control flow when the call is not a standalone statement. For example, warning(cond) && next() becomes (cond || reportCall()) && next(); if cond is falsy, reportCall() returns a truthy event-id string, so next() runs even though the original warning would have returned undefined and skipped it. Similarly, assert(cond) && next() with a truthy cond evaluates to cond (truthy) after transformation, causing next() to run, whereas the original assert returns undefined (falsy) and would skip it. No parent-context check restricts the rewrite to ExpressionStatement nodes, and no tests cover expression-context usages.

This test's title and comment describe a dangling format specifier, but messageArgs provides four values for three specifiers so the i >= args.length branch in formatMessage is never exercised here.

Return eventId ?? '' instead of raw eventId so the public API always returns a string as declared.

In packages/core/src/js/assertion.ts, the unguarded error.message = message assignment throws when options.error has a non-writable message property (e.g., a frozen or sealed Error). Because the file is an ES module and runs in strict mode, this can turn a report-only assertion into an unexpected crash and prevents hard preconditions from re-throwing their original error.