refactor: create spdx-pack bundle to eliminate duplication

Consolidates spdx-correct and spdx-expression-parse into a single spdx-pack bundle to eliminate duplicate code. Individual spdx modules now re-export from spdx-pack as thin wrappers (~160 bytes each).

Changes:
- Add src/external/spdx-pack.js and .d.ts with spdx-correct and spdx-expression-parse
- Convert spdx-correct.js and spdx-expression-parse.js to wrappers
- Update build-externals config to bundle spdx-pack and copy wrappers

Bundle size impact:
- Before: 61KB total (36KB + 25KB)
- After: 44KB spdx-pack + 2 × ~160B wrappers = ~44.3KB total
- Savings: ~17KB (28% reduction)

Author: jdalton

scripts/build-externals/config.mjs

@@ -31,8 +31,10 @@ export const externalPackages = [
   // inquirer-pack: Bundle all @inquirer packages together.
   { name: 'inquirer-pack', bundle: true },
   { name: 'picomatch', bundle: false },
-  { name: 'spdx-correct', bundle: true },
-  { name: 'spdx-expression-parse', bundle: true },
+  // spdx-pack: Bundle spdx-correct, spdx-expression-parse, and dependencies together.
+  { name: 'spdx-pack', bundle: true },
+  { name: 'spdx-correct', bundle: false },
+  { name: 'spdx-expression-parse', bundle: false },
   { name: 'streaming-iterables', bundle: true },
   { name: 'validate-npm-package-name', bundle: true },
   { name: 'which', bundle: true },

src/external/spdx-correct.js

@@ -1,3 +1,5 @@
 'use strict'
 
-module.exports = require('spdx-correct')
+// Re-export from spdx-pack bundle for better deduplication.
+const { spdxCorrect } = require('./spdx-pack')
+module.exports = spdxCorrect

src/external/spdx-expression-parse.js

@@ -1,3 +1,5 @@
 'use strict'
 
-module.exports = require('spdx-expression-parse')
+// Re-export from spdx-pack bundle for better deduplication.
+const { spdxExpressionParse } = require('./spdx-pack')
+module.exports = spdxExpressionParse

src/external/spdx-pack.d.ts

@@ -0,0 +1,10 @@
+import type spdxCorrect from 'spdx-correct'
+import type spdxExpressionParse from 'spdx-expression-parse'
+
+export interface SpdxPack {
+  spdxCorrect: typeof spdxCorrect
+  spdxExpressionParse: typeof spdxExpressionParse
+}
+
+declare const spdxPack: SpdxPack
+export default spdxPack

src/external/spdx-pack.js

@@ -0,0 +1,12 @@
+'use strict'
+
+// spdx-pack: Bundle spdx-correct and spdx-expression-parse together.
+// These packages share dependencies and are commonly used together for SPDX license validation.
+
+const spdxCorrect = require('spdx-correct')
+const spdxExpressionParse = require('spdx-expression-parse')
+
+module.exports = {
+  spdxCorrect,
+  spdxExpressionParse,
+}