fix: correct mf manifest expose assets

[2heal1]

Summary

Fix Module Federation manifest expose asset collection so each expose uses its own entry chunk instead of falling back to the first chunk in the async block group.

Add a regression case that keeps multiple expose entries separated while still allowing shared sync assets to appear in both exposes.

Root cause

The manifest plugin previously recorded the first named chunk from each expose chunk group. In complex chunk groups, that first chunk can belong to another expose or a shared chunk, so the manifest can assign unrelated expose entry files to the current expose.

Validation

• cargo fmt -p rspack_plugin_mf
• cargo check -p rspack_plugin_mf
• pnpm --filter @rspack/test-tools build
• pnpm run build:binding:dev
• pnpm run build:js
• env testFilter=/Users/bytedance/outter/rspack/tests/rspack-test/configCases/container-1-5/manifest-multiple-exposes pnpm --dir tests/rspack-test test:base Config.part1.test.js
• Verified the reported app manifest no longer includes __federation_expose_AdgroupEditModule under CreativeEditModule after rebuilding with the local Rspack package.

[codspeed-hq]

Merging this PR will improve performance by 8.44%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 2 improved benchmarks
✅ 12 untouched benchmarks
⏩ 11 skipped benchmarks¹
🗄️ 2 archived benchmarks run²

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
⚡	Simulation	bundle@threejs-development	816.5 ms	729.3 ms	+11.97%
⚡	Simulation	bundle@threejs-production-sourcemap	2.1 s	2 s	+5.03%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing 2heal1:codex/fix-mf-manifest-expose-assets (f292ee3) with v1.x (239bb47)³}

Footnotes

1. 11 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. 2 benchmarks were run, but are now archived. If they were deleted in another branch, consider rebasing to remove them from the report. Instead if they were added back, click here to restore them. ↩

3. No successful run was found on v1.x (ea89956) during the generation of this report, so 239bb47 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[2heal1]

CI note: I checked the branch against the latest origin/v1.x; this is not caused by the PR branch being outdated.

The latest v1.x still uses version-tagged references in the shared artifact composite actions:

• actions/upload-artifact@v4
• actions/download-artifact@v4.1.7

Current CI rejects those unpinned references and fails during artifact upload/download. I previously touched a wider set of workflow files, but that broader change has been reverted. The remaining .github changes only pin the two shared artifact actions that are actually used by this PR's CI.

Keeping this in the PR for now so CI can pass on v1.x. If v1.x fixes these shared artifact actions separately, we can drop these two lines from this PR later.