migrate to ESM and upgrade @actions/* to latest majors

[BrandonLWhite]

Summary:

Upgrades @actions/core to 3.0.1, which is ESM-only, and migrates the
repository from CommonJS to native ESM to make that possible.
@actions/cache and @actions/exec move to 6.2.0 and 3.0.0 in the same
change because they are ESM-only at those majors too, and because
@actions/cache@5 pins @actions/core@^2 — bumping core alone would
resolve a second, nested CommonJS copy of core into the bundle. This lifts
the constraint that AGENTS.md and .agents/INSTRUCTIONS.md previously
carried as the repository's central hard rule.

The action's workflow interface is untouched: action.yml inputs are
byte-identical, runs.using stays node24, and observable behavior is
unchanged.

Actions:

• Bumped @actions/core 2.0.3 to 3.0.1, @actions/cache 5.2.0 to 6.2.0,
  and @actions/exec 2.0.0 to 3.0.0, and set "type": "module".
• Converted src/ and __tests__/ to import/export, node: builtin
  specifiers, and explicit .js extensions on relative imports.
• Replaced the suite's jest.spyOn(module, 'export') mocking, which frozen
  ESM namespaces make impossible, with jest.unstable_mockModule against
  new fixtures in __fixtures__/. Two fixtures are deliberately partial
  rather than pure stubs, because mocking a module replaces it for every
  consumer: core.js re-exports the real @actions/core since
  @actions/cache imports named exports from it (setSecret among them),
  and fs-promises.js keeps readFile real so the TOML fixtures still
  load while mocking only symlink and stat.
• Dropped the jest.spyOn(main, 'run') self-spy, which ESM makes
  impossible and which only asserted that run reached its end.
• Replaced @vercel/ncc with rollup, matching the upstream
  actions/javascript-action template. Three deviations from that template:
  @rollup/plugin-json is required here because @actions/cache imports
  its own package.json, and sourcemaps are off because the map is ~16.5MB
  and dist/ is committed.
• Set commonjs({ ignoreTryCatch: false }), which is mandatory rather than
  stylistic. Several bundled dependencies probe for optional modules with
  require() inside a try/catch (minimatch resolves path that way; undici
  probes node:http2 and node:crypto). The plugin leaves those alone by
  default, and in an ESM bundle require is undefined, so the throw is
  swallowed and each dependency silently takes a degraded fallback. minimatch
  fell back to sep: '/', which stopped Windows paths from matching and broke
  @actions/cache's saveCache on windows-latest only. This was a
  regression from ncc, not from the @actions/cache major — resolvePaths is
  byte-identical between cache 5.2.0 and 6.2.0 and minimatch is 3.1.5 in both
  trees. Added __tests__/dist.test.js to assert the committed bundle has no
  executable bare require(, and verified it fails without the fix.
• Kept dist/licenses.txt via rollup-plugin-license, attributing 43
  bundled packages. The bundle inlines the whole production tree, including
  the Azure Storage SDK that @actions/cache@6 adds.
• Extracted Jest config into jest.config.js with transform disabled,
  and removed four dead Babel devDependencies that had no config anywhere
  in the repository.
• Rewrote the obsolete "do not bump @actions/* past their CommonJS
  majors" rule in AGENTS.md and .agents/INSTRUCTIONS.md into ESM
  guidance, and recorded the design under docs/superpowers/specs/.
• Verified the cache save path deliberately, because a green CI run does not
  exercise it: both OS jobs normally restore from an existing key and skip
  saveCache, so the Windows bug was invisible. Forcing a miss by salting the
  cache key on a throwaway branch reproduced the failure, and after the fix
  windows-latest wrote all three caches (13.19 MB poetry, 6.99 MB tox, 531 KB
  poethepoet). Both pitfalls are now documented in .agents/INSTRUCTIONS.md.
• Verified beyond a green build: 10 tests pass with coverage unchanged at
  100% statements/lines/functions and 92.85% branches, a clean npm ci
  reports 0 vulnerabilities, the committed dist/ matches a fresh build,
  and the bundle was executed directly to confirm it loads as ESM —
  printing Nothing to install. and exiting 0 for the empty-pyproject
  fixture, and emitting ::error:: with exit 1 for a missing file.

BREAKING CHANGE: The repository's source and its bundled dist/index.js are
now ESM rather than CommonJS. This does not change the action's workflow
interface — action.yml inputs, runs.using: node24, and runtime behavior
are all unchanged, so no consumer workflow needs updating. It does break
forks, patches, or tooling that expect require()/module.exports in
src/ or dist/index.js.