fix(package): stop shipping src/ tree in published tarball

[sroussey]

Summary

c7e3c4a intended files: ["dist"] (verbatim per its final commit message) but the landed diff kept "src" from an earlier revision. 13f9d06 then flipped "private": false, so bun publish on 0.0.11 shipped the whole 77 MB src/ tree — 267 *.test.ts, ~15 MB of committed EDGAR HTML mock_data, and the golden-truth SPAC corpus.

Changes

• package.json — remove "src" from files; add prepack-check script; wire into release before bunset.
• scripts/checkPackedContents.ts (new) — inspects bun pm pack --dry-run output, fails on *.test.ts, mock_data/, or unpacked size > 5 MB.
• CLAUDE.md — one paragraph documenting why src must not be re-added.

Why not keep src with exclusion sub-globs?

The use-source dev-flow (scripts/bunsrc.ts) is workspace-local: it edits this workspace's package.json via bun pm pkg set exports=..., and bun link'd consumers read live source from disk. No consumer needs src/*.ts inside the tarball; keeping src with excludes preserves a large tarball surface and invites future fixture-secret leakage.

Verification

• bun pm pack --dry-run — no .test.ts / mock_data/ entries; unpacked size 2.91 MB (was 75.38 MB).
• Real bun pm pack — tarball 1609 files, 544 KB gzipped / 2.91 MB unpacked.
• bun ./dist/sec.js --help works.
• import("./dist/index.js") resolves the library barrel (45 exports).
• bun run use-source / bun run use-dist flip works unchanged.
• bun run prepack-check exits 0 on clean tarball, non-zero when src is re-added (927 forbidden files, 74.65 MB flagged).

Note on the check script: bun pm pack --dry-run in bun 1.3.11 has no --json mode (it silently ignores the flag and emits plain text). The script tries bun pm pack --json first, then falls back to npm pack --dry-run --json (which returns well-defined JSON with files[].path + unpackedSize), then finally to parsing bun's plain-text listing — so the safeguard fires with or without npm on PATH.

Follow-ups (not in this PR)

• 0.0.11 is already on the registry. Recommend npm deprecate @workglow-dev/sec@0.0.11 "ships 77MB of test fixtures; use 0.0.12+" (do NOT unpublish — breaks downstream lockfiles).
• Latent bug: src/eval/embarcUnitTermsReference.ts, src/eval/realSections.ts, and src/task/fixtures/fetchS1Fixtures.ts resolve mock_data paths via import.meta.dir, which after bundling into dist/index.js collapses to the dist/ folder — those subcommands were already broken for installed users regardless of src shipping. Separate fix warranted.

---

Generated by Claude Code