fix: replace deno -A with specific permission flags in bundle.ts

Replaces overly broad -A with targeted permissions.
Detected by panic-attack assail batch scan (2026-03-30).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

scripts/bundle.ts

@@ -3,8 +3,8 @@
 // cannot handle via import maps.
 //
 // Usage:
-//   deno run -A scripts/bundle.ts          # one-shot build
-//   deno run -A scripts/bundle.ts --watch  # watch mode for dev
+//   deno run --allow-read --allow-write --allow-env --allow-net scripts/bundle.ts          # one-shot build
+//   deno run --allow-read --allow-write --allow-env --allow-net scripts/bundle.ts --watch  # watch mode for dev
 
 import * as esbuild from "npm:esbuild@0.24";