Improve shipcue package trust metadata

[rogerchappel]

What changed

• Added npm package trust metadata for repository, issue tracker, homepage, and author provenance.
• Documented local verification commands in the README when they were missing.

Why it matters

Package consumers and future maintainers can trace the source repo, report issues, and run the same lightweight verification before packaging changes.

Verification

• package json parse: pass; npm pack --dry-run: pass

Limitations / follow-up

• This pass focuses on package credibility and docs/DX; it does not add new runtime coverage.