Improve shipcue package readiness

[rogerchappel]

What changed

• Included checked-in support and release docs in the npm files allowlist.

Why it matters

Package consumers can trace the published artifact back to the public repository and receive the same license, security, changelog, and contribution context that exists in the repo.

Verification

• npm pack --dry-run

Remaining limitations

• No runtime behavior changed in this package-readiness pass.