fix(build): make Worker-safe connector package installable from Git

[drewstone]

Closes a real Builder launch blocker at its source

The maintained narrow OAuth/Hub/Sandbox exports exist, but consuming the exact source as a Git dependency failed during prepare: Node refuses to strip tsdown.config.ts under pnpm's node_modules/.../store/... path. Retained original failure: Builder run 36512071660, artifact 11009570800.

Use a native ESM tsdown.config.mjs, with explicit JSDoc UserConfig so declaration generation remains portable from nested paths. No new loader dependency, vendored connector, node_modules patch, install-policy bypass, or duplicate OAuth. Keep config checking with allowJs/checkJs and update the existing release fixture's filename.

Exact final verification

Head ce360e0f4f4ff37a30e8e92fa33c0edee61ead8e:

• Read-only Nested package build run 36521104672 passed. Actual checkout underneath node_modules, frozen install and prepare, complete tsc, build, real imports of OAuth/Hub/Sandbox exports, and unchanged manifest/lock.
• Existing Verify PR run 36521104526 passed: frozen install, complete source typecheck and test suite, packed release verification without publication, and actual consumer packing.
• The first nested run exposed a declaration portability error after successfully finding the .mjs config. The explicit UserConfig annotation fixes it; that failed result is not counted as passing.

No registry publication, provider call, deployment, or production credential use. Builder must adopt the narrow entrypoints and this exact package source or its later verified published release; merging this source alone does not fix a still-pinned broad consumer import.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.