v0.2.2

Changed

• Source maps are no longer published in the npm tarball. Node reads them only
  under --enable-source-maps, which nothing here sets, and the maps pointed at
  a src/ this package does not ship — so a stack trace under that flag named a
  file nobody could open. dist/**/*.js is unchanged; the package is about a
  fifth smaller.
• oxlint's suspicious category is on; 7 findings fixed (mostly
  Array#toSorted() over copy-and-sort and un-shadowed names). No runtime
  behaviour changed.