Minor: the thumbnails entry point is purely additive. No export removed or
renamed, no value changed, and the zaes.com catalog output is byte-identical.

Also records an SBOM blind spot found while checking the README's dependency
claim. `npm sbom --omit dev` reported 32 production components; the real closure
is 34 -- it silently omits tslib (0BSD) and @types/geojson (MIT), both real
transitive dependencies of every @turf module. The README's "34 packages -- 32
MIT, one Unlicense, one 0BSD" was correct all along and is unchanged. Trusting
the SBOM would have rewritten an accurate licensing claim into a wrong one.

That matters beyond this release: the checklist uses the SBOM as its license
gate, and a package it drops silently is a license the gate cannot catch. It now
says to confirm the total against the dependency closure itself, and warns off
`npm ls --all`, which counts the optional peers and reports ~208.