Improve shipcue package release readiness

[rogerchappel]

What changed

• Adds missing npm package trust metadata or support-document package contents where needed.
• Tightens CI to run package smoke coverage where this branch updates the workflow.

Why it matters

Developers installing or reviewing shipcue get clearer npm metadata, package contents that include support docs, and CI that is less likely to miss packaging regressions.

Verification

• npm ci: pass
• npm run check --if-present: pass
• npm test --if-present: pass
• npm run package:smoke --if-present: pass

Remaining limitations

• No package was published and no release tag was created.
• This PR stays focused on release/package hygiene; deeper feature or fixture work remains separate.