feat: publish the registry as the root package's bin

[lmcorbalan]

Summary

Closes #159

The root manifest becomes the npm face of the repository: a scoped name, a bin that starts the registry service, and a files allowlist that actually ships the built output. A consumer can now pin this repo as a git dependency and run the service.

Changes

• package.json: @bootnodedev/canton-token-forge 0.2.0, type: module, repository, engines, bin, files.
• The dist ignore rule moves from registry/.gitignore to the root as registry/**/dist, because a nested ignore file outranks the files allowlist during the pack walk.
• registry/src/index.ts gains a shebang; the node floor rises to 20, which two runtime dependencies require.

Acceptance criteria

• All nine from the issue are met.

Test plan

Automated tests

Registry build, both typechecks, lint (40 files), 205/205 unit tests.

Manual verification

From a fresh clone: npm ci vendors nothing and emits 16 files to registry/dist; npm pack yields exactly 24 entries; that tarball installed into a consumer outside the repo runs its bin and exits 1 on its own config error. Five mutations all red, including putting dist back beside the code (0 dist entries shipped) and dropping "type": "module" (the ES module fails to load).

Breaking changes

The supported node floor moves from 18 to 20. Two packages in the runtime closure already required it, so >=18 was a promise the package could not keep.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.