fix: guard add and update outside project root

[2543679596-sketch]

Summary

• Fail fast when stampui add or stampui update is run outside a project root without package.json
• Add a --force escape hatch for intentional bare-directory use
• Add a small hasPackageJson helper with tests
• Document the behavior in README and CHANGELOG

Closes #3

Test Plan

• npm test
• npm run typecheck
• npm run build
• Manual check in a temp directory:
  • node dist/index.js add token-stream exits with No package.json found...
  • node dist/index.js update exits with No package.json found...
  • node dist/index.js update --force proceeds to the existing lock-file message