ci: drop attw from package verification, keep publint (#43)

@arethetypeswrong/cli crashes ("Cannot read properties of undefined (reading
'filename')") decompressing this package's tarball — its core overwrites the
fflate Gunzip output per chunk instead of concatenating, so any package large
enough to stream in multiple chunks (ours: 341KB/92 files) loses all but the
last empty chunk. That's a checker bug, not a problem with the generated package.

Rather than carry a local patch + pinned dep for a third-party tool, drop attw
entirely. publint remains the gating export validator. Removes the pinned
@arethetypeswrong/cli dev dep, the bun patch, and the attw script/CI step added
in #41/#42.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: samuelho-dev

.github/workflows/ci.yml

@@ -47,17 +47,7 @@ jobs:
         run: bun run build
 
       - name: Verify package
-        run: |
-          npx --yes publint
-
-          # Use the locally installed (pinned + patched) attw, NOT npx-latest.
-          # Upstream @arethetypeswrong/core crashes ("Cannot read properties of
-          # undefined (reading 'filename')") on tarballs that gunzip into multiple
-          # chunks; fixed via patches/@arethetypeswrong%2Fcore@0.18.2.patch (upstream
-          # PR: arethetypeswrong/arethetypeswrong.github.io#263). attw gates again —
-          # drop the patch + pin and return to `npx --yes` once the fix is released.
-          # ESM-only package: don't require CJS support, and ignore node10.
-          bun run attw --pack . --profile node16 --ignore-rules cjs-resolves-to-esm
+        run: npx --yes publint
 
   coverage:
     name: Coverage