Bump package.json version to 5.28.0 and finalize the changelog entry
for the release. Tightens the dlx/package installRoot bullet to one
sentence + clarifier; long-form contract lives in the JSDoc.

This is the final commit on top of v5.27.0..HEAD; the ensurePackageInstalled
installRoot work and the rename to that name landed earlier on this
branch (3485a6b feat, 800c7fd changelog, e82e180 rename).