Consider replacing tsup with raw esbuild + tsc --emitDeclarationOnly

## Consider dropping tsup for raw esbuild + `tsc --emitDeclarationOnly`

tsup is a thin wrapper over esbuild in this repo, and the build already reaches
around it in ways that suggest we'd be simpler without it:

- **`tsup.config.ts` is mostly esbuild passthrough** — `esbuildPlugins` (the
`#wasm` / `#wasm-base64-data` resolver), `define` (`__WASM_SHA256__`,
`__PACKAGE_VERSION__`), and `external`/`noExternal`. Little is tsup-specific.
- **Declaration generation is done twice.** `tsup.config.ts` sets `dts: true`,
then `build.mjs` runs a separate `npx tsc --emitDeclarationOnly --declarationMap`
that *overwrites* tsup's `.d.ts` (to add declaration maps). So tsup's dts pass
is wasted work.
- **The anon-rpc worker build uses raw esbuild anyway** (single hash-pinned
IIFE, bundling tor-js from source with `@kpstreams/*` external). Standardizing
the library build on esbuild too means one bundler across both artifacts.

Proposed: replace the tsup step in `build.mjs` with a direct `esbuild` build API
call (same entry map, `format: 'esm'`, the existing plugin + `define` + external
config) and keep the single `tsc --emitDeclarationOnly --declarationMap` for
types. Net: fewer deps, no duplicate dts, one bundler.

Non-urgent — tsup works today; this is a simplification, not a fix. Filed while
building the anon-rpc worker (which needs raw esbuild + `@kpstreams` external).

Start with build.mjs and tsup.config.ts, comparing the existing tsup settings with the raw esbuild worker build and the separate tsc --emitDeclarationOnly --declarationMap step. Replace only the library bundling path as proposed, preserve the entry map, plugins, defines, and external settings, and verify that the build produces equivalent bundles and declaration maps without the duplicated dts pass.

Written by the indexing model from the issue text.