Bash script to vendor in NPM packages to your repo

This script makes it easy to copy an NPM package into a `vendor/` dir.

Helps against supply-chain attacks, and also makes it easier for LLMs to investigate how packages work.

Warning: Opus 4.5 did most of the work (but we use this in prod)