chore(package): restrict published files to runtime artifacts (#190)

[SAY-5]

Closes #190.

The published tarball currently ships dev-only files (tests, `.github/` workflows, `eslint.config.js`, `tsconfig.json`, `bench.js`, the `test/ts/transpile.sh` scripts, etc.) because `package.json` has no `files` field and relies on the npm default excludelist.

Before (`npm pack --dry-run` on `main`)
```
npm notice total files: 61
npm notice package size: 20.2 kB
npm notice unpacked size: 81.1 kB
```

After
```
LICENSE
README.md
index.d.ts
index.js
lib/indexes.js
lib/wait.js
lib/worker.js
package.json
npm notice total files: 8
npm notice package size: 9.9 kB
npm notice unpacked size: 34.7 kB
```

Added an explicit `files` allowlist covering the runtime entrypoints (`index.js`, `index.d.ts`, `lib/`). `LICENSE`, `README.md`, and `package.json` are always included by npm. This also makes the published contents independent of the working tree at publish time, so stray `.husky` / IDE / editor swap files can no longer leak into the tarball regardless of what's on disk.

Full `npm test` suite: 50 passing / 3 pre-existing skipped — unchanged by this PR.

[kshitijanurag]

Please see fastify/skeleton#42 (comment) for an explanation of why this is invalid.

[SAY-5]

Thanks for the link. The concern in fastify/skeleton#42 is about maintenance burden of listing individual files. In this PR, the files array uses directory entries ("lib/") rather than individual files, so adding new source files under lib/ doesn't require a package.json update. The three entries — index.js, index.d.ts, lib/ — cover all runtime artifacts and are stable across normal development.

That said, if the maintainers prefer a different approach (e.g. .npmignore), happy to adapt.