feat(library): vendor the TypeScript SDK library and build its bundle - #21

Module bindings import their runtime from ./core.js, a bundle that until now
only existed inside the engine image — which is why this repo could generate a
module's bindings but not the library they run against. Vendor the library and
build the bundle here instead.

The source is dagger/dagger's sdk/typescript at v1.0.0-beta.9, the engine these
checks run against, minus what does not belong to the library itself: the Go
runtime module (which stays upstream), the test and lint tooling, the upstream
changelog, and its dagger.json — a stray module config here would be discovered
as a workspace module. src/api/client.gen.ts is left out too; the packager
already generates it.

A copy has no merge base git can compute, so the one it would have had is
written down: library/VENDOR.md records the tag, the commit, what was left
behind, the exhaustive list of local deltas, and the re-import procedure.
Without it a re-vendor is a blind overwrite, and these deltas are small enough
to lose without noticing. The inherited README is replaced for the same reason —
it described an npm workflow, in a directory that has none.

libraryBundle builds core.js and core.d.ts with the same commands and the same
pinned bun image as toolchains/engine-dev/build/sdk.go, so a module built
against this bundle behaves like one built against the engine's. Verified: it
exports the runtime the generated bindings import (Context, BaseClient) and the
decorators modules are written with (object, func, field, enumType, entrypoint,
...).

The declaration build takes the compiler the lockfile resolves, via `bun x`,
rather than a globally installed one. A global `bun install -g typescript` is
whatever the registry served that day, so the .d.ts we ship could move on an
unchanged tree — the one part of the bundle that would not be reproducible.

The bundle is committed rather than built on demand: the SDK reads it at
generate time, and building it there would put a bun toolchain in the critical
path of every `dagger generate`.

Signed-off-by: Tom Chauveau <tom@dagger.io>

The vendored scripts all pointed at things this repo does not have: mocha,
eslint and tsx were left behind with the tests they serve, and the docs scripts
reach for ../../docs/current_docs. Only `build` was live, and the packager
already runs tsc itself. Drop them, and trim devDependencies and resolutions to
what the bundle build actually uses (rollup, rollup-plugin-dts, the @types the
declaration build needs) so package.json describes the package while the
packager owns how it is built.

Keep yarn.lock: it is load-bearing, not vendored ceremony. Installing without
it resolves newer transitives and grows core.js from 4.3 MB to 5.4 MB, so the
bundle would silently stop matching the one the engine ships.

Signed-off-by: Tom Chauveau <tom@dagger.io>