docs: replace broken bundlephobia badge with bundlejs

[github-actions]

Closes #67

loop-task: #67

Why

The README bundle-size badge is broken. https://img.shields.io/bundlephobia/minzip/tiny-oss returns HTTP 200, but the SVG title is bundlephobia: rate limited by upstream service: upstream bundlephobia.com/api/size returns HTTP 429 service-wide (open reports since 2019). shields.io answers 200 even for an error badge, so this could not be caught by the HTTP-status-only check that added the badge in #54.

What

Replace the image and link in both READMEs (docs-only, 2 insertions / 2 deletions):

-[![bundle size](https://img.shields.io/bundlephobia/minzip/tiny-oss)](https://bundlephobia.com/package/tiny-oss)
+[![bundle size](https://img.shields.io/bundlejs/size/tiny-oss)](https://bundlejs.com/?q=tiny-oss)

README.md and README_zh-CN.md stay in parity; the badge label (bundle size) and row order are unchanged. No source, signer, dependency or .github/workflows/** change, so the signer oracle pinning and tree-shaking are unaffected. Commit type docs per AGENTS.md.

Verification

• New badge https://img.shields.io/bundlejs/size/tiny-oss — HTTP 200, <title>minified size (gzip): 7.9 kB</title> (a real figure, not an error banner).
• New link target https://bundlejs.com/?q=tiny-oss — HTTP 200.
• Repo-wide bundlephobia search after the change — 0 hits.
• pnpm lint — 0 warnings / 0 errors.
• pnpm fmt:check — all files formatted.
• pnpm build — exit 0; pnpm check:types — exit 0.
• pnpm test:azure-oracle and pnpm test:tos-oracle — all checks passed.
• pnpm serve + pnpm exec vitest run --browser.headless — 24 files passed, 255 passed / 26 skipped.

Review

Two-lens review (correctness/regression and standards/safety) found no L1/L2 problems; the independent pr-review stage re-checks the diff.

[github-actions]

Coverage

Metric	%	Covered / Total
Lines	91.73%	1121/1222
Statements	90.42%	1209/1337
Functions	92.76%	218/235
Branches	76.97%	575/747

[github-actions]

Loop pr-review — approve ✅

Independent check of the diff (README.md +1/−1, README_zh-CN.md +1/−1 — the bundle-size badge line only), separately from the feature (maker) run.

• Correctness/regression — the defect and the fix were both reproduced from this runner: the old https://img.shields.io/bundlephobia/minzip/tiny-oss answers HTTP 200 but its SVG body is <title>bundlephobia: rate limited by upstream service</title> (an error banner — exactly why List the common badges in readme file #54's status-only check missed it); the new https://img.shields.io/bundlejs/size/tiny-oss answers HTTP 200 with <title>minified size (gzip): 7.9 kB</title>, and the link target https://bundlejs.com/?q=tiny-oss is HTTP 200. The figure is plausible: the built default entry dist/tiny-oss.es.js gzips to 7,847 B ≈ 7.9 kB. git grep -i bundlephobia over the tracked tree is now 0 hits (state/ is the gitignored loop state layer, not the published repo). Both READMEs stay in parity with the label and row order unchanged; no source, signer, dependency or workflow file is touched, so the oracles and tree-shaking are unaffected.
• Standards/safety — docs commit type per AGENTS.md; loop-PR contract holds (loop/67-bundlejs-badge head, Closes #67, loop-task: #67); commit is attributed to github-actions[bot] (the chore(loop): attribute loop commits to github-actions[bot] #57 fix); no secrets or dangerous patterns.

Gates re-run from this checkout: pnpm lint 0 warnings / 0 errors, pnpm fmt:check clean, pnpm build exit 0 and then pnpm check:types exit 0, pnpm test:azure-oracle and pnpm test:tos-oracle all passed, browser suite 24 files / 255 passed / 26 skipped. CI Lint and Test are green on this head; mergeable: MERGEABLE and blocked only on the ruleset's required approving review.

No L1/L2 problems. One L3 non-finding: the README prose still says "about 10kb" next to the 7.9 kB badge — pre-existing, untouched here, and not a reason to block this fix. Awaiting the owner's approving review and merge.