chore: remove unused root package.json and lockfile (#241)

The root package.json (sun-valley) was an accidental npm init -y added in
the client impl commit (933d335). It has the default index.js main with no
index.js, the npm init test stub, and is not referenced by CI, Dockerfiles,
scripts or any workspace config. The actual npm code lives in clients/ and
bin/sponsor-service/, each with its own package.json. Removing the orphan
manifest also stops spurious Dependabot alerts on dependencies nothing uses.

Author: randygrok