Fix ESM module loading for Node.js 18 compatibility

- Replace Function constructor with eval for better Node 18 compatibility
- Add proper error handling with helpful messages
- Escape single quotes to prevent injection
- This fixes CI failures with ora package in Node.js 18 environment

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

Author: Matt-Dionis

claude-config-composer/src/utils/esm-loader.ts

@@ -3,8 +3,16 @@
  * This works around TypeScript's transformation of dynamic imports
  */
 export async function loadEsmModule<T = any>(moduleName: string): Promise<T> {
-  // Use Function constructor to prevent TypeScript from transforming the import
-  const dynamicImport = new Function('moduleName', 'return import(moduleName)');
-  const module = await dynamicImport(moduleName);
-  return module.default || module;
+  try {
+    // Use eval to preserve the import() expression
+    // This prevents TypeScript/bundlers from transforming it
+    // We escape single quotes to prevent injection
+    const module = await eval(`import('${moduleName.replace(/'/g, "\\'")}')`);
+    return module.default || module;
+  } catch (error: any) {
+    // If import fails, provide helpful error message
+    throw new Error(
+      `Failed to load ESM module '${moduleName}': ${error?.message || 'Unknown error'}`
+    );
+  }
 }