bump-docs.cjs read the version from `npm view fuse.js version` (the
latest published version). The release flow runs `npm run docs:bump`
before `npm publish`, so it saw the previous version and bumped the docs
one release behind (hit on 7.4.1). Read from the local package.json,
which standard-version bumps before the docs step, so it reflects the
version being cut. Also drops the network call and child_process use.

logError now sets process.exitCode = 1, so a failed or partial build
(failed entry bundle or type generation) ends with a non-zero exit
instead of silently exiting 0. CI and the release flow can no longer
treat a broken build as success. Still logs and continues so every
error in the run is reported.

Clears two high-severity dev-only Dependabot advisories in the transitive
fast-uri (path traversal GHSA-q3j6-qgpj-74h6, host confusion
GHSA-v39h-62p7-jpjc), pulled via @commitlint -> ajv -> [email protected].
fast-uri does not ship (dist-only, no runtime deps); dev-toolchain
hardening. Resolves to a single [email protected]; lint + tests pass.

Collapse the hand-rolled Rollup orchestrator (scripts/configs.cjs +
config-types.cjs + build.main.cjs, 373 lines) and 8 build devDeps into one
tsdown.config.ts (rolldown engine + built-in dts). Chosen over tsup after a
problem-blind Codex assessment and a spike: tsdown emits constructor-direct
CJS (require('fuse.js') === Fuse) and named worker CJS automatically, no
footer hacks.

Behavior-preserving on the public surface:
- identical 15-file dist set (12 runtime + 3 dts)
- CJS require() contract unchanged; named fuse-worker.cjs export preserved
- feature-flag DCE intact (basic build strips logical/extended/token)
- dev/prod default-export split preserved
- Fuse.version injected via define (bare __VERSION__ + ambient declare;
  honors process.env.VERSION for releases)

Worker-URL resolution no longer depends on a bundler's import.meta.url
codegen: a per-format __WORKER_IS_CJS__ define routes browser-CJS to a
document base while ESM keeps the literal new URL('./fuse.worker.mjs',
import.meta.url) so bundlers still detect and rewrite the worker asset.
test/worker-url.test.js gates node-ESM, node-CJS, browser-ESM (Vite), and
browser-CJS. test/cjs-interop.test.js gates require() === constructor for
every lib cjs plus the named worker cjs.

Sizes: minified artifacts are 287-313 bytes smaller raw; gzip is +8..+28
bytes (<=0.4%, accepted) since rolldown's minifier compresses marginally
worse than Terser.

Build/release now requires Node >=22.18 (tsdown engines): CI builds on 22/24
and runs the Node 20 leg against the committed dist. docs-deploy
reconciliation is descoped (deploy-docs.sh is the only path that bumps docs
before deploy; needs a release-ordering fix first).

Removed devDeps: rollup, @rollup/plugin-babel, @rollup/plugin-node-resolve,
@rollup/plugin-replace, @babel/core, @babel/preset-typescript, terser,
rollup-plugin-dts. Added: tsdown.

…780)

The package shipped a single ESM-interpreted `.d.ts` reused for both the
`import` and `require` exports conditions. Because the package is
`"type": "module"`, TypeScript reads that declaration as ESM, so CommonJS
consumers on `moduleResolution: node16`/`nodenext` doing
`import Fuse from "fuse.js"` hit TS1479 (arethetypeswrong "masquerading as
ESM"). The lib CJS runtime is `module.exports = Fuse`, whose runtime-accurate
type is `export =`, not `export default`.

Generate a sibling `.d.cts` per CJS-capable entry in the tsdown build: the lib
declaration becomes a namespace merge + `export = Fuse` with the named types
re-exported type-only; the worker (named `exports.FuseWorker`) is copied
verbatim. Rewrite the exports map to nested import/require `types` conditions
and point the top-level `types` at the `.d.cts`.

attw --pack . now reports the main entry all-green (node10/node16/bundler) and
every CJS-capable subpath resolving under node16-CJS. Adds a `cjs` mode to
test/package-types.test.ts covering require/`export =`, default+named, the full
public type surface through the namespace merge, and a guard that type-only
members stay type-only (no false runtime value members).

Fixes #780