fix: Fixed --watch-file being ignored for hidden files - #3837

Fixes #2282.

web-ext run --watch-file .build-finished never reloads the extension. web-ext accepts the option and then silently does nothing: every change event is dropped, with only a debug-level line to show for it. Touching a sentinel file when an external build finishes is the documented reason to use --watch-file, and sentinel files are usually hidden, so this is the common case rather than an edge case.

Every change event Watchpack emits is passed through shouldWatchFile in src/watcher.js, including events for the files the user named. src/extension-runners/index.js binds shouldWatchFile to the source directory's FileFilter, and the base ignore patterns in src/util/file-filter.js include **/.*, so proxyFileChanges discards the change and only writes "Ignoring change to:" at debug level. The same thing happens to a watched *.zip or *.xpi and to anything under node_modules, because those patterns sit in the same list.

The fix resolves the --watch-file entries once and lets a change to one of them through whatever the filter says. That also beats the user's own --ignore-files patterns for those exact paths, which seems right since naming a single file with --watch-file is the more specific instruction, but it is worth stating rather than leaving to be discovered. Everything else is left alone: the artifacts directory check in proxyFileChanges is untouched, and exclusions that apply at the watcher level, such as --watch-ignored, are untouched because those paths are never watched in the first place. That last point is also why this stays compatible with the _metadata exclusion in open PR #3696, which lives in Watchpack's ignored list and not in the filter; #3696 also edits the same watchChange test helper, so whichever lands second needs a small rebase.

Two notes on scope. The bug only bites when the watched file is inside sourceDir, since the filter resolves its patterns against sourceDir, and the default sourceDir is the current directory, which is the situation in the issue. The reporter also suggested the opposite resolution, rejecting dot files in --watch-file with an error instead; reloading looks clearly more useful, but say so if you prefer the error.

Two unit tests cover this, both in the --watch-file block and both built on the real FileFilter: one touches a watched .build-finished, one touches a watched build.zip. The shared watchChange helper hardcoded shouldWatchFile as () => true, which is why no test ever exercised this interaction, so it now takes a filter factory and the existing cases keep their old behaviour. Both new tests fail on master. The watcher unit tests, eslint and prettier --check pass on the two changed files.