🧹 refactor: cut the duplicated checks and prose from the tree-shaking work

Acting on ponytail-review. The findings were about verification written twice
and comments restating the CHANGELOG, not about the fixes themselves.

- dist/cjs/package.json had two writers: the build script echoed it, then
  build-bundle.mjs rewrote it three lines later with the sideEffects entry.
  One writer now, the one that knows what belongs in it.
- Dropped the banner-version assert. Same process, same `pkg.version` going in
  and coming out — the "stale bundle" it claimed to catch cannot happen.
- Dropped the `includes('toInstanceSync')` text check. ci.yml imports the flat
  bundle and typeof-checks the export, which is the same claim actually tested.
- Dropped the treeshake case asserting annotations survive minification; the
  build already asserts it. Its one non-duplicated assertion was the floor on
  the expected count, and that gap was real: the build compared flat >= esm, so
  if tsc ever stopped emitting annotations both sides would read 0 and the
  assert would pass on nothing. Folded in as an explicit `expected < 30` check,
  verified by stripping the annotations and watching the build fail.
- Removed the `CEREALE` placeholder from treeshake.test.ts. A template language
  for one variable, with two no-op `.replace('CEREALE', 'unused')` calls left
  behind by it. Interpolated directly.
- Removed `.replace(/\.js$/, '.js')`, which was the identity function.
- Trimmed the comment above the `Symbol.metadata` install from 16 lines to 7,
  and the one above `minifySyntax` from 9 to 3, keeping the parts that are not
  written down anywhere else.

Also synced the CHANGELOG's byte table to the README's. The two had already
diverged in the webpack column — which is the duplication the review warned
about, showing up before anyone edited either on purpose.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SAcqrz3FcadkYr3xG32CjK

src/metadata.ts

@@ -15,22 +15,13 @@ import type { ClassConstructor } from './interfaces.js';
  */
 const METADATA_KEY: symbol = (Symbol as { metadata?: symbol }).metadata ?? Symbol.for('Symbol.metadata');
 
-// Also installed globally, because a consumer's own compiler emit reads `Symbol.metadata`
-// directly and does not share our fallback. tsc emits
+// Also installed globally: tsc's decorator emit reads `Symbol.metadata` directly rather than
+// falling back the way we do — `typeof Symbol === "function" && Symbol.metadata ? … : void 0` —
+// so without this a decorated class gets `metadata: undefined` and no rules at all.
 //
-//   const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
-//
-// so on a runtime without the well-known symbol the class is decorated with `metadata:
-// undefined` and ends up with no metadata at all. (esbuild's `__knownSymbol` has the same
-// `Symbol.for` fallback we do and needs nothing from us; tsc does.)
-//
-// `sideEffects` in package.json is what keeps this statement through bundling — and it has to
-// name `index.ts`/`index.js` as well as this module. Marking only this one is not enough: the
-// barrel is then itself side-effect-free, so a bundler drops the `export * from './metadata.js'`
-// edge before this module's own marking is ever consulted, and the install silently vanishes.
-// Measured on `import { configure } from 'cereale'`: absent from all three of esbuild, webpack
-// and rollup until the barrel was listed too. It costs ~100 bytes, and only for imports that
-// pull in nothing else — every entry point that touches a model was already byte-identical.
+// `sideEffects` in package.json keeps the statement through bundling, and must name `index.*`
+// as well as this module: marking only this one leaves the barrel droppable, so the edge to it
+// is pruned before this marking is ever read. Pinned by treeshake.test.ts.
 ((Symbol as { metadata?: symbol }).metadata as symbol | undefined) ??= METADATA_KEY;
 
 export interface ValidationArguments {