refactor(shared): make the argument guards tree-shakeable

[ExorTek]

Independent. Internal only — no public API changes.

bindAsserts built one object holding all fourteen guards and handed it back. A bundler can include or exclude that function, but it cannot take the object apart, so the destructure list in each internal/guards.js decided nothing about what shipped. Every package that touched the module carried all fourteen: jwks called three and shipped fourteen, and assertBoolean reached fifteen published packages without a single call site anywhere in the repo.

Each guard is now a standalone make… factory taking the package's wrap, and each internal/guards.js imports the ones it calls:

import { makeAssertObject, makeInvalidArgument } from '@exortek/shared/asserts';

const wrap = (message, extra) => new JweError(ErrorCode.INVALID_ARGUMENT, message, extra);

export const assertObject = makeAssertObject(wrap);
export const invalidArgument = makeInvalidArgument(wrap);

Named imports are something a bundler can follow, so the rest is dropped. The composer layer (bindAsserts / defineGuards) is gone — binding a guard is one line now, and the indirection bought nothing.

Measured across the built bundles

package	before	after
jwk	178 KB	146 KB	-18.2%
otp	239 KB	200 KB	-16.5%
security	454 KB	411 KB	-9.4%
jws	254 KB	236 KB	-6.9%
crypto	475 KB	443 KB	-6.7%
session	333 KB	311 KB	-6.6%
total	2.07 MB	1.88 MB	-9.0%

oauth2 is unaffected — it never used this module.

Behaviour is unchanged: same errors, same codes, same messages, and every call site still imports the same names from its local guards module. AGENTS.md's guard convention is rewritten to match, and now says why the import list has to track the call sites rather than leaving it as style.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.