Replace dumble with tsdown for JS bundling

dumble (0.2.x, ~530 dl/wk, single-maintainer) was a bus-factor risk as
the load-bearing bundler. tsdown (rolldown-based, ~2.5M dl/wk, actively
maintained) replaces it while output stays list-identical, verified by
snapshot diff: 17 JS bundles, externals preserved, schemastery dual
.mjs/.cjs and logger-console node+browser entries intact.

Root tsdown.config.ts uses workspace globs ['vendor/*', 'packages/*']
(explicit, so examples/* stays excluded); two per-package overrides in
vendor/ cover the special shapes and are logged in vendor/README.md as
ours (not upstream sync surface). scripts/build.ts (dumble
orchestration) is deleted; yarn build = tsc -b && tsdown. tsc -b keeps
owning declarations (dts: false, clean: false).

Rationale recorded in ADR 0008 (also covers the direct-esbuild and
pkgroll alternatives).

Gates: lint, typecheck, 134 tests, hygiene (knip/publint/constraints),
demo smoke all green.

scripts/build.ts

@@ -1,29 +0,0 @@
-import { execFileSync } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import { resolve } from 'node:path'
-
-// Bundle JS for every workspace package with dumble (tsc -b has already
-// produced the .d.ts files; dumble reads each package's tsconfig/package.json).
-const packages = [
-  'vendor/cosmokit',
-  'vendor/schemastery',
-  'vendor/cordis',
-  'vendor/loader',
-  'vendor/include',
-  'vendor/group',
-  'vendor/timer',
-  'vendor/hmr',
-  'vendor/logger-console',
-  'packages/llm',
-  'packages/session',
-  'packages/system-prompt',
-  'packages/tools',
-  'packages/agent',
-  'packages/agent-loop',
-]
-
-const root = resolve(import.meta.dirname, '..')
-for (const path of packages) {
-  if (!existsSync(resolve(root, path, 'tsconfig.json'))) continue
-  execFileSync('node_modules/.bin/dumble', [path], { cwd: root, stdio: 'inherit' })
-}