fix: getBrandVersion throws on ES5 browsers; make test:types runnable

Both from Qodo review on #632.

`Parser.getBrandVersion()` called `Array.prototype.find` directly. That is
ES6, and `es5.js` ships no polyfills, so a documented public API threw
`TypeError: this._hints.brands.find is not a function` on exactly the
browsers that bundle exists to serve. `bundled.js` was unaffected because
core-js polyfills it. Every other lookup in parser.js already goes through
`Utils.find`, which guards on `Array.prototype.find` and falls back to a
loop; this one call site had missed it. `hasBrand()` next to it uses
`Array.prototype.some`, which is ES5, and is fine.

The ES5 runtime guard added alongside it did not catch this because nothing
exercised the Client Hints path. It now does, for both bundles.

That test builds its hints object from a script evaluated *inside* the vm
context rather than assigning one onto it. A first attempt assigned a
host-realm object and passed against the live bug: an array created in the
host realm keeps the host's `Array.prototype`, so its `find` survives the
sandbox's delete. A real browser hands the parser a same-realm array.

`pnpm test:types` passed no tarball, and check.mjs exited 1 when the argument
was absent, so the advertised command could never run — CI only passed
because it packs and invokes the file directly. The argument is now optional:
without one the package is assembled from the `files` allowlist in the
working tree. `npm pack` cannot be used for this, as package.json carries no
`version` until release time and npm refuses to pack without one. Missing
build output is reported as such rather than as a type error.

Verified by reverting the parser fix: the es5.js Client Hints test fails with
the original TypeError while the bundled.js one still passes, which is the
correct split. Parse output is unchanged — all four artifacts still agree
across the 270-UA corpus, and Client Hints still resolve on modern runtimes.

test/acceptance/test-es5-runtime.js

@@ -77,6 +77,51 @@ test('the ES5 sandbox actually strips the modern APIs', (t) => {
   });
 });
 
+/**
+ * Client Hints go down a different code path than `parse()` — `isBrandVersion`
+ * and `getBrandVersion` reach into `_hints.brands` directly — so the checks
+ * above never touch them. `getBrandVersion` used `Array.prototype.find`, which
+ * is ES6, and threw on exactly the browsers `es5.js` exists for.
+ *
+ * The inputs are built by a script evaluated *inside* the context rather than
+ * assigned onto it. An array created in the host realm keeps the host's
+ * `Array.prototype`, so its `find` survives the sandbox's delete and the test
+ * passes against a bug that is still there. A real browser hands the parser a
+ * same-realm array, which is what this reproduces.
+ */
+['es5.js', 'bundled.js'].forEach((file) => {
+  test(`${file} handles Client Hints on an ES5-only global`, (t) => {
+    const context = createEs5Context();
+    vm.runInContext(fs.readFileSync(path.join(root, file), 'utf8'), context);
+
+    const result = vm.runInContext(`
+      var ua = ${JSON.stringify(UA)};
+      var hints = {
+        brands: [
+          { brand: 'Chromium', version: '131' },
+          { brand: 'Google Chrome', version: '131' },
+        ],
+        mobile: false,
+        platform: 'macOS',
+      };
+      var parser = this.bowser.getParser(ua, false, hints);
+      ({
+        brandVersion: parser.getBrandVersion('Google Chrome'),
+        missingBrand: parser.getBrandVersion('Firefox'),
+        hasBrand: parser.hasBrand('Google Chrome'),
+        hasOtherBrand: parser.hasBrand('Firefox'),
+        hints: !!parser.getHints(),
+      })
+    `, context);
+
+    t.is(result.brandVersion, '131');
+    t.is(result.missingBrand, undefined);
+    t.true(result.hasBrand);
+    t.false(result.hasOtherBrand);
+    t.true(result.hints);
+  });
+});
+
 test('bundled.js installs the polyfills it promises', (t) => {
   // The README tells consumers to reach for bundled.js when they have no
   // polyfills of their own, so it has to actually populate the environment.