refactor: convert validate-npm-package-name to wrapper

Adds validate-npm-package-name to npm-core bundle and converts the standalone module to a thin wrapper that re-exports from npm-core for better deduplication.

Changes:
- Add validate-npm-package-name to src/external/npm-core.js and .d.ts
- Convert src/external/validate-npm-package-name.js to wrapper
- Update build-externals config to set validate-npm-package-name bundle: false

Bundle size impact:
- Before: 3.6KB standalone
- After: 171B wrapper (validate-npm-package-name now bundled in npm-core)
- Savings: ~3.4KB (94% reduction in wrapper overhead)

Author: jdalton

scripts/build-externals/config.mjs

@@ -36,7 +36,7 @@ export const externalPackages = [
   { name: 'spdx-correct', bundle: false },
   { name: 'spdx-expression-parse', bundle: false },
   { name: 'streaming-iterables', bundle: true },
-  { name: 'validate-npm-package-name', bundle: true },
+  { name: 'validate-npm-package-name', bundle: false },
   { name: 'which', bundle: true },
   { name: 'yargs-parser', bundle: true },
   { name: 'yoctocolors-cjs', bundle: true },

src/external/npm-core.d.ts

@@ -1,11 +1,13 @@
 import type npmPackageArg from 'npm-package-arg'
 import type normalizePackageData from 'normalize-package-data'
 import type * as semver from 'semver'
+import type validateNpmPackageName from 'validate-npm-package-name'
 
 export interface NpmCore {
   npmPackageArg: typeof npmPackageArg
   normalizePackageData: typeof normalizePackageData
   semver: typeof semver
+  validateNpmPackageName: typeof validateNpmPackageName
 }
 
 declare const npmCore: NpmCore

src/external/npm-core.js

@@ -1,14 +1,16 @@
 'use strict'
 
-// npm-core: Bundle npm-package-arg, normalize-package-data, and semver together
-// These packages share dependencies and are commonly used together for package spec parsing
+// npm-core: Bundle npm-package-arg, normalize-package-data, semver, and validate-npm-package-name together.
+// These packages share dependencies and are commonly used together for package spec parsing.
 
 const npmPackageArg = require('npm-package-arg/lib/npa.js')
 const normalizePackageData = require('normalize-package-data/lib/normalize.js')
 const semver = require('semver')
+const validateNpmPackageName = require('validate-npm-package-name')
 
 module.exports = {
   npmPackageArg,
   normalizePackageData,
   semver,
+  validateNpmPackageName,
 }

src/external/validate-npm-package-name.js

@@ -1,3 +1,5 @@
 'use strict'
 
-module.exports = require('validate-npm-package-name')
+// Re-export from npm-core bundle for better deduplication.
+const { validateNpmPackageName } = require('./npm-core')
+module.exports = validateNpmPackageName