fix(cli): os lint --eval --json stops leaking esbuild's diagnostics to stderr, and the pin now covers every door

fix(cli): os lint --eval --json stops leaking esbuild's diagnostics to stderr, and the pin now covers every door #7900