ref(build): replace local hole-punch script with binpunch package (#246)

## Summary

- Replace the local `script/hole-punch.ts` with the published
[`binpunch`](https://www.npmjs.com/package/binpunch) npm package
([source](https://github.com/BYK/binpunch))
- Delete `script/hole-punch.ts` and `test/lib/hole-punch.test.ts` (tests
now live in the package repo)
- Remove the `hole-punch` npm script from `package.json`

The build behavior is unchanged — `script/build.ts` still calls
`processBinary()` to zero unused ICU data entries before gzip
compression.

Author: BYK

bun.lock

@@ -13,7 +13,6 @@
     "dev": "bun run src/bin.ts",
     "build": "bun run script/build.ts --single",
     "build:all": "bun run script/build.ts",
-    "hole-punch": "bun run script/hole-punch.ts",
     "bundle": "bun run script/bundle.ts",
     "typecheck": "tsc --noEmit",
     "lint": "bunx ultracite check",
@@ -38,6 +37,7 @@
     "@types/node": "^22",
     "@types/qrcode-terminal": "^0.12.2",
     "@types/semver": "^7.7.1",
+    "binpunch": "^1.0.0",
     "chalk": "^5.6.2",
     "esbuild": "^0.25.0",
     "fast-check": "^4.5.3",

package.json

@@ -22,9 +22,9 @@
 
 import { promisify } from "node:util";
 import { gzip } from "node:zlib";
+import { processBinary } from "binpunch";
 import { $ } from "bun";
 import pkg from "../package.json";
-import { processBinary } from "./hole-punch.js";
 
 const gzipAsync = promisify(gzip);