build: restrict published files to dist

Add a files whitelist so the npm tarball ships only the compiled dist/
output (plus package.json/README/LICENSE), excluding src, tests, and
local config that 0.1.6 inadvertently published.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: julianrichie

package.json

@@ -5,6 +5,9 @@
   "main": "dist/index.js",
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
   "sideEffects": false,
   "engines": {
     "node": ">=18"