💥 Modernize the toolchain and ship dual ESM + CJS

[SylvainEstevez]

Fifth repo through the modernization runbook in the workspace CHECKLIST.md, after
url (the pilot), thrown, http-method and schema. pnpm · tsdown (dual ESM + CJS) ·
Vitest · Biome · TypeScript 7 · shared CI from tselect-npm/.github@v1.

The title is :boom: deliberately. Squash is the only merge method the rulesets
allow, so this PR collapses to one commit and that commit's gitmoji is the only one
the release workflow reads. :wrench: would infer as no release at all. The branch's
series is preserved below, since this is the only place it survives.

:bug:                 Stop shipping a 1.35 MB stray log in the published package
:wrench:              Migrate to pnpm
:sparkles:            Add dual ESM + CJS build via tsdown, on TypeScript 7
:white_check_mark:    Migrate test suite to Vitest
:rotating_light:      Replace TSLint with Biome
:memo:                Add LICENSE, a full README API section and correct metadata
:construction_worker: Run CI from the org-wide reusable workflow

Headline fix: the published package ships a 1.35 MB log

@tselect/status-code@1.0.2 is 32 files and 1,369,746 bytes unpacked, of which
1,352,289 are a single .log22069 left over from a 2023 test run. tslint.json rode
along too. The .gitignore had .log*, so the file was invisible to git status while
npm included it in every publish — the registry tarball is the only thing that tells you
what actually ships.

The cause is .npmignore: a denylist cannot enumerate files that did not exist when it
was written. Replaced with "files": ["dist"]. The tarball is now 9 files and
7,970 bytes.

Also fixed: prepare: "tsc" was a silent no-op, because tsconfig.json sets
noEmit: true. A clean checkout would have packed an empty dist/; it only worked
because dist/ happened to exist in the publishing tree.

Why this is a major

1. engines.node is now ">=22" — the bottom of the CI matrix, so the floor is
   tested by construction. >=20 is not viable regardless: pnpm 11 requires
   node >=22.13.
2. The exports map closes deep imports. No consumers of
   @tselect/status-code/dist exist anywhere public — the search returns nothing for
   the package at all.
3. isStatusCode(value: any) becomes isStatusCode(value: unknown). This is a
   widening, so no existing call stops compiling, but it is a public signature change.

Coverage, and a quirk pinned rather than fixed

The inherited suite reported 100% of statements, functions and lines but only 90% of
branches, below the 95% floor. Coverage is now 100% of all four, via seven new
assertions in five tests. The gaps were toString's || null fallback and
isConsumerErrorStatusCode's non-status-code path. That is the third repo running where
the statement column looked finished and the branch column did not.

Two of the new tests pin behaviour rather than assert intent. StatusCode is a numeric
enum, so its runtime object carries a reverse mapping and Object.values yields the 43
member names alongside the 43 numbers:

isStatusCode('OK');                      // true  — not a typo
toString('OK' as unknown as StatusCode); // '200'

That has been the published behaviour since 1.0.0, so this tooling refresh preserves
it rather than quietly changing a type guard's answers. It is now documented under a
warning in the README, with the typeof value === 'number' && isStatusCode(value)
workaround, and pinned by tests that explain the cause.

toString also trips Biome's noShadowRestrictedNames, twice, and stays — it is the
published export name, and renaming it would break every consumer for a cosmetic gain.
Suppressed with biome-ignore at the two sites that need it, each carrying its reason,
rather than switched off in biome.json.

Verification

Differential-tested against the published 1.0.2 tarball after every source-touching
commit: 115 inputs (all 43 enum values, all 43 member names, and 29 edge cases including
NaN, Infinity, null, undefined, '200', 'OK', booleans, {} and []) across
all 11 functions, run against both new entry points, plus enum contents and export
names — 2,534 comparisons, 0 mismatches.

Every README example was executed rather than just written: 210 assertions, all
passing, typechecking clean under strict + nodenext. The three prose claims were
checked across the whole enum rather than at one example each — that
isServerErrorStatusCode/isConsumerErrorStatusCode are aliases of is5xx/is4xx,
that isNonErrorStatusCode is the complement of isErrorStatusCode over valid codes,
and that "at or above 400" is exactly 4xx ∪ 5xx.

From a clean clone of this branch: 34 tests, 100% coverage on all four metrics,
pnpm audit 0 (from 15), biome check and tsc --noEmit clean, attw clean on all
four resolution modes, es-check es2015 on both bundles, both declaration files non-empty
at 2,624 bytes, and require() and import agreeing on all 12 exports.

Notes

• No tag surgery needed. Unlike the other repos in this scope, v1.0.2 already sits
  on a1569df — exactly the commit the registry reports as 1.0.2's gitHead — so the
  release workflow's commit range resolves on the first try. The 17 remaining
  @bluejay-era tags are clutter, but none collides with the v2.0.0 this major wants,
  so they are left alone.
• master was renamed to main as part of this work. That retargeted the stale
  Dependabot PR ⬆️ Bump serialize-javascript and mocha #16 automatically; it is moot once this merges, since it patches a
  package-lock.json that no longer exists for a mocha that is no longer a dependency.
• Publishing is deferred until all seven repos are modernized. The version stays
  1.0.2 and the major goes out with the others at the end.