fix: keep internal OWNERS out of the public npm package

The current package inspector intentionally excludes internal ownership metadata and requires only the public plugin manifest plus shipped skill files. Retain the two policy skill files and remove the non-public OWNERS file.

Author: mldangelo-oai