fix: restore ES5 output for bundled.js, and assert it

`bundled.js` stopped being ES5 when the webpack build was replaced by tsdown
in #628. It parses at ecmaVersion 2015 but not 5:

    var t=(t,e)=>()=>(e||(t((e={exports:{}}).exports,e),t=null),e.exports)

That is rolldown's `__commonJS` interop helper. `@rolldown/plugin-babel` only
transforms input modules, and rolldown appends the helper afterwards; terser
with `ecma: 5` avoids introducing newer syntax but does not transpile, so the
arrow functions reached the published file. `es5.js` has no CommonJS
dependencies and never gets the helper, which is why only `bundled.js` broke.

The effect is total rather than partial: in an ES5 engine the whole script is
a SyntaxError, so `bundled.js` — the bundle that exists specifically to serve
those engines, polyfills included — does not load at all there.

Lower the emitted chunk with a babel renderChunk pass that runs after bundling
and before terser, so rolldown's own helpers are covered too. Costs 2.8 kB
(+1.6%) on bundled.js; es5.js is unchanged at 34 kB.

The existing guard was a grep for backticks, which this syntax slips straight
past. Replace it with an acorn parse at ecmaVersion 5 over both legacy
bundles, plus a tokeniser check for real template literals (backticks inside
core-js string literals are fine, and 2.14.1 shipped three of them).

Verified by reverting the build fix: `bundled.js parses as ES5` fails, and
passes again once restored. Also confirmed bundled.js loads and parses the
live navigator.userAgent in a real browser.

package.json

@@ -89,6 +89,7 @@
     "@babel/register": "^7.29.7",
     "@eslint/js": "^10.0.1",
     "@rolldown/plugin-babel": "0.2.3",
+    "acorn": "^8.18.0",
     "ava": "^3.0.0",
     "babel-plugin-add-module-exports": "^1.0.4",
     "babel-plugin-istanbul": "^8.0.0",