awaitly-visualizer: The miasma continues to floweth — a binding.gyp Bun worm

No install hook to flag — npm auto-builds the binding.gyp it ships, which fetches its own Bun runtime to run a credential-harvesting worm outside node's view, forge Sigstore provenance, and republish the maintainer's other packages.