build.ts debug ID injection and sourcemaps

Build outputs must always receive a real Sentry debug ID during local and authenticated builds. Chose fixed-length replacement of every PLACEHOLDER_DEBUG_ID over auth-gated injection because local bundles still need debuggability and UUID replacement preserves sourcemap offsets. Gate upload inside the plugin; server deployments must never expose sourcemaps to end users, and maps are deleted only after successful upload. Use esbuild over Bun’s bundler because Bun produced identifier collisions and broken sourcemap names.