Migrate to @actions/core 3.x and @actions/exec 3.x (ESM)

[devusb]

Context

@actions/core 3.x and @actions/exec 3.x are ESM-only. Our codebase is CommonJS, so upgrading requires a full ESM migration. Major bumps are currently ignored in Dependabot via #175.

What needs to change

• package.json — add "type": "module", update scripts
• src/index.js — require() → import
• src/main.js — require() → import, module.exports → export
• src/index.test.js — rewrite to ESM, replace jest.mock() with jest.unstable_mockModule() + async import()
• src/main.test.js — same as above; every mock must explicitly define all exports
• Bundler — @vercel/ncc may not support ESM input; may need to switch to esbuild or rollup
• patch-package patch for @actions/exec — needs updating or removal

Why not now

• Jest ESM support is still experimental (--experimental-vm-modules, jest.unstable_mockModule())
• @vercel/ncc cannot bundle ESM-only dependencies into CJS
• The migration is fiddly (mock rewriting, import ordering) rather than large in line count

How we'll know when 2.x is EOL

• npm install will print deprecation warnings
• GitHub dependency graph / Dependabot alerts will flag deprecated packages
• Dependabot PRs will show deprecation warnings
• Security alerts will fire for any CVEs against 2.x regardless of ignore rules