build: drop --sourcemap from production bundle

Removes esbuild's --sourcemap flag from the inline build command.
Sourcemaps shipped 524 KB on top of the 4.2 MB bundle (matters for
marketplace install size and activation overhead) and aren't needed
in production.

Bundle audit (esbuild --metafile + per-input size sort) found:
- src/data/go/mod-parser.wasm:                 2.99 MB (load-bearing)
- node_modules/json-to-ast/build.js:            136 KB
- node_modules/toml-eslint-parser/lib/index.mjs: 65 KB
- node_modules/@socketsecurity/lib/.../socket.js: 4.9 KB
- everything else: < 30 KB each

Only one @socketsecurity/lib leaf file reaches the bundle. The
socket-packageurl-js stubs plugin targets globs.js/sorts.js, neither
of which is in our import graph — adding the plugin would be a
no-op. Skipping.

Shipped size:
  before: out/main.js 4.2 MB + out/main.js.map 524 KB
  after:  out/main.js 4.2 MB

Author: jdalton

package.json

@@ -97,7 +97,7 @@
     "clean": "node -e \"require('node:fs').rmSync('out',{recursive:true,force:true})\"",
     "compile": "pnpm run esbuild",
     "cover": "pnpm run test -- --coverage",
-    "esbuild": "pnpm exec esbuild --bundle --external:tree-sitter-java --external:vscode --loader:.wasm=binary --loader:.go=file --loader:.py=text --outdir=out/ --platform=node --sourcemap --format=cjs main=src/extension.ts --define:EXTENSION_VERSION=\"\\\"$npm_package_version\\\"\"",
+    "esbuild": "pnpm exec esbuild --bundle --external:tree-sitter-java --external:vscode --loader:.wasm=binary --loader:.go=file --loader:.py=text --outdir=out/ --platform=node --format=cjs main=src/extension.ts --define:EXTENSION_VERSION=\"\\\"$npm_package_version\\\"\"",
     "fix": "node scripts/fix.mts",
     "format": "oxfmt --write .",
     "format:check": "oxfmt --check .",