Harden package artifact checks

[rogerchappel]

Summary

• include README-documented demo and tutorial assets in the npm package allowlist
• add a package smoke checker that verifies runtime files, support docs, fixtures, demo, and tutorial assets from npm pack --dry-run --json
• add a real package library entrypoint so package.json main resolves after build
• update README package contents notes to match the release artifact surface

Verification

• npm install
• npm run package:smoke
• npm run release:check

Note: npm install reported existing audit findings in the current dependency tree: 3 moderate, 1 high, and 1 critical.