chore: disable minification of dist bundles

[John-David Dalton (jdalton)]

The files that actually run in every consumer's CI job are dist/main.js and dist/post.js — the bundled output, not src/. Until now they were minified, which meant the one artifact people most want to audit before trusting a security action was the one artifact nobody could read.

Dropping the terser plugin from the rollup config makes the bundles readable, so you can see exactly what a release contains just by opening the file.

The dist files get larger as a result. That is fine here: GitHub Actions downloads them once per job and they are never served to a browser, so bundle size buys nothing that readability does not beat.

Keeping the PR diffs usable — .gitattributes marks dist/ as generated

Unminified bundles would otherwise turn every build commit into a huge, noisy diff. A new .gitattributes sets dist/** -diff linguist-generated, so GitHub collapses the generated output by default and excludes it from language stats. The files stay fully readable when you open them — they just stop drowning the review.

Removing the plugin also drops @rollup/plugin-terser and its @jridgewell/* source-map dependencies from the lockfile.

The test plan — unchecked; two things to confirm before merge

• Verify npm run build still produces working dist/main.js and dist/post.js
• Confirm the action runs correctly in a workflow

[John-David Dalton (jdalton)]

Superseded, with one line kept.

The minification half is already done on main and better enforced than this branch proposed: #14 replaced the rollup build with rolldown, whose config sets minify: false, and bundle-flags-guard now blocks a minified shipped bundle outright. rollup.config.js and package-lock.json no longer exist, so those hunks have nothing to apply to.

The .gitattributes change was still wanted and landed in 974a6e2 — dist/** -diff linguist-generated, so the committed bundle stays out of diffs and language stats.