feat!: replace bundled pnpm binary with npm + lockfile bootstrap

Remove the 9MB bundled pnpm.cjs/worker.js and instead use npm ci with
committed package-lock.json files (~5KB) to install a bootstrap pnpm,
which then installs the target version with integrity verification via
the project's pnpm-lock.yaml.

Also switch from ncc to esbuild and modernize to ESM.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

package.json

@@ -1,10 +1,11 @@
 {
   "private": true,
+  "type": "module",
+  "packageManager": "pnpm@10.32.1",
   "scripts": {
-    "build:ncc": "ncc build --minify --no-source-map-register --no-cache dist/tsc/index.js --out dist/",
-    "build": "tsc && pnpm run build:ncc",
-    "start": "pnpm run build && sh ./run.sh",
-    "update-pnpm-dist": "pnpm install && cp ./node_modules/pnpm/dist/pnpm.cjs ./dist/pnpm.cjs && cp ./node_modules/pnpm/dist/worker.js ./dist/worker.js"
+    "build:bundle": "esbuild src/index.ts --bundle --platform=node --target=node24 --format=esm --minify --outfile=dist/index.js --loader:.json=json",
+    "build": "pnpm run build:bundle",
+    "start": "pnpm run build && sh ./run.sh"
   },
   "dependencies": {
     "@actions/cache": "^4.1.0",
@@ -18,8 +19,7 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
-    "@vercel/ncc": "^0.38.1",
-    "pnpm": "^8.14.3",
+    "esbuild": "^0.27.4",
     "typescript": "^5.3.3"
   }
 }