refactor: pull side effect out of action bundle import

[mcous]

This PR switches our mocking library from testdouble + testdouble-vitest to vitest-when.

Testdouble is excellent, but we have to jump through some hoops to get it to work nicely with vitest. Switching to vitest-when gives us a very similar stubbing API without the overhead of opting-out of vitest's automocking / mock functions.

To make this change possible, I needed to remove a wart from the action code: prior to this PR, importing the action bundle ran the action. This side-effect on import was difficult to test, and the fact that our tests worked at all for this behavior was more brittle than I realized.

Now, the action bundle exports a main function, and there's a simple action.js at the top-level of the repository that imports and calls that function. This is symmetrical with how the CLI works, with a simple wrapper called bin/npm-publish.js that imports and executes the CLI code from the compiled lib directory.