chore(sdk/js): restrict published package to dist/ only

add a \"files\" allowlist so npm pack ships only README, LICENSE,
package.json, and dist/. drops .npmignore (replaced by the allowlist).

before: 60 files / 230 KB unpacked / 57 KB tarball, including bun.lock,
src/*.ts, test-outputs.js, tsconfig*.json, and .claude/settings.local.json.

after: 43 files / 133 KB unpacked / 30 KB tarball — ~47% smaller, no
extraneous files leaking out of the repo.

Author: Leechael

sdk/js/.npmignore

@@ -75,6 +75,9 @@
   "engines": {
     "node": ">=18.0.0"
   },
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "build": "npm run build:node && npm run build:browser",
     "build:node": "tsc -p tsconfig.node.json",