Convert action source to ESM

@actions/tool-cache 4.0.0 is ESM-only (per its 4.0.0 changelog,
"CommonJS consumers must use dynamic import() instead of require()"),
so the existing CommonJS source breaks ncc bundling once that bump
lands. Switching the project to native ESM unblocks the dependabot
upgrade in #13 while remaining backward-compatible with tool-cache@2.x
already in the lockfile.

Author: claude

package.json

@@ -2,6 +2,7 @@
   "name": "setup-kosli-cli",
   "version": "1.0.0",
   "description": "Sets up the Kosli CLI for GitHub Actions runners",
+  "type": "module",
   "main": "dist/index.js",
   "scripts": {
     "test": "ava",

src/download.js

@@ -1,5 +1,4 @@
-const path = require("path");
-const github = require("@actions/github");
+import * as github from "@actions/github";
 
 // Map node arch to arch in download url
 // arch in [arm, x32, x64...] (https://nodejs.org/api/os.html#os_os_arch)
@@ -23,13 +22,13 @@ function mapOS(os) {
   return mappings[os] || os;
 }
 
-function getDownloadUrl({ version, platform, arch }) {
+export function getDownloadUrl({ version, platform, arch }) {
   const filename = `kosli_${version}_${mapOS(platform)}_${mapArch(arch)}`;
   const extension = platform === "win32" ? "zip" : "tar.gz";
   return `https://github.com/kosli-dev/cli/releases/download/v${version}/${filename}.${extension}`;
 }
 
-async function resolveVersion(version, token, octokit) {
+export async function resolveVersion(version, token, octokit) {
   if (version !== "latest") {
     return version;
   }
@@ -46,5 +45,3 @@ async function resolveVersion(version, token, octokit) {
   const tag = release.data.tag_name;
   return tag.startsWith("v") ? tag.slice(1) : tag;
 }
-
-module.exports = { getDownloadUrl, resolveVersion };

src/index.js

@@ -1,8 +1,7 @@
-const path = require("path");
-const os = require("os");
-const core = require("@actions/core");
-const tc = require("@actions/tool-cache");
-const { getDownloadUrl, resolveVersion } = require("./download");
+import os from "os";
+import * as core from "@actions/core";
+import * as tc from "@actions/tool-cache";
+import { getDownloadUrl, resolveVersion } from "./download.js";
 
 async function setup() {
   try {
@@ -32,8 +31,4 @@ async function setup() {
   }
 }
 
-module.exports = setup;
-
-if (require.main === module) {
-  setup();
-}
+setup();

test/download.test.js

@@ -1,5 +1,5 @@
-const test = require("ava");
-const { getDownloadUrl, resolveVersion } = require("../src/download");
+import test from "ava";
+import { getDownloadUrl, resolveVersion } from "../src/download.js";
 
 const baseUrl = "https://github.com/kosli-dev/cli/releases/download/";
 const testCases = [