chore: tighten npm package metadata

[cafitac]

Summary

• Make npm package metadata OSS-facing with a short description, discoverability keywords, and explicit public publish config.
• Keep the npm package file surface intentionally tiny: launcher, README, package metadata, and license only.
• Add tests that assert both package metadata and npm pack --dry-run tarball contents, and record the package-surface checkpoint in .dev status docs.

Verification

• git diff --check
• uv run --python 3.11 pytest tests/test_npm_launcher.py tests/test_roadmap_contract.py -q
• npm pack --dry-run --json