feat: resolve core_version at install time instead of at runtime

[marcalexiei]

• New approach after feat: resolve core_version at install time instead of at runtime #113

core_version is resolved at run time:
index.js calls npm install --no-save --no-package-lock into a mkdtemp directory and loads the result
through createRequire + pathToFileURL.

Change

The action resolves core_version at install time, and index.js drops to a plain await import().
An invalid input now fails before any of our code runs; it is validated and passed via env, never interpolated.

pnpm install --frozen-lockfile --prod --ignore-scripts

# only when core_version is set
pnpm pkg delete "dependencies[<core>]"
pnpm install --no-frozen-lockfile --prod --ignore-scripts --loglevel error
pnpm add <core>@$CORE_VERSION --prod --ignore-scripts --loglevel error

Core has to leave the lockfile before it can be re-resolved: pnpm add alone returns the
locked version whenever it satisfies the spec, so v2 would reinstall the pin.
pnpm remove would delete and prune in one step, but it reinstalls the devDependencies --prod skipped.

The frozen install always runs first, so only core's subtree can move.
Diffing the resolved prod tree against a plain frozen install, 2.1.3 is identical and v2 / latest / 2.1 differ only in core itself.

[marcalexiei]

Opened:

• 🐛 Valid pnpm subcommands reported as unlisted binaries webpro-nl/knip#1944

PR fixing the issue:

• fix(binaries): resolve missing pnpm subcommands webpro-nl/knip#1945

[marcalexiei]

Hi @martin-mfg,
Could I get a review on this when you have a moment?
It's independent of my other open PR, so the two can be merged in either order.