feat: external sourcemap upload for compiled binaries

Two-step build: bundle TS → JS+sourcemap, then compile JS → binary.
The sourcemap is uploaded to Sentry for server-side stack trace
resolution, never shipped to users in the binary.

Impact vs current (no sourcemaps):
  Download size: +0.04 MB gzipped (+0.1%)
  Delta patches:  +0.83 KB per release
  Binary size:   +0.54 MB raw (+0.5%)

Impact vs inline sourcemaps:
  Download size: -2.26 MB gzipped (saved)
  Delta patches: -36.22 KB per release (saved)
  Binary size:   -3.23 MB raw (saved)

This gives Sentry accurate function names and file paths for:
- Proper issue grouping (merges CLI-1D/BW/98 into one issue)
- Accurate stack traces (no more minified func/BJ8/pp1 names)
- Better error classification (splits misgroued CLI-N events)

Build changes:
- script/build.ts: Step 1 bundles with external sourcemap,
  Step 2 compiles the JS without re-minifying
- CI: passes SENTRY_AUTH_TOKEN to build-binary job for upload
- Intermediate JS/map files cleaned up after compile

Author: BYK

.github/workflows/ci.yml

@@ -225,6 +225,8 @@ jobs:
       - name: Build
         env:
           SENTRY_CLIENT_ID: ${{ vars.SENTRY_CLIENT_ID }}
+          # Sourcemap upload to Sentry (non-fatal, skipped when token is absent)
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           # Set on main/release branches so build.ts runs binpunch + creates .gz
           RELEASE_BUILD: ${{ github.event_name != 'pull_request' && '1' || '' }}
         run: bun run build --target ${{ matrix.target }}