packaging: slim the npm tarball and make pack-smoke measure the published tarball

[LinuxDevil]

Closes #191
Closes #316

Implements #191 option A (the ticket's recommended option): the issue had no owner answer recorded when work started, so this PR implements A as specified; B and C remain possible follow-ups if the owner prefers.

What changed

• package.json files: added !src/**/*.test-d.ts, !src/**/*.testkit.ts, !src/**/__snapshots__ and !apps/agent-forge/dist-server/*.map (after the positive apps/agent-forge/dist-server entry). Also added !src/**/__cassettes__ — the owner's note on pack-smoke: the tarball size cap is reached (main at 14.63 of 14.68 MB) #316 says cassette/fixture exclusion is part of the same decision (__fixtures__ was already excluded). src/ stays.
• tsup.config.ts: esbuildOptions sets options.sourcesContent = false, so the SDK's maps no longer embed the source a second time. Verified dist/index.js.map has no sourcesContent and all 31 sources entries still resolve from dist/ to ../src/... files that ship in the package.
• scripts/pack-smoke.ts:
  • main() also runs npm run build:studio (unless --skip-build), so it packs the tarball prepublishOnly actually publishes — previously it skipped the Agent Forge build and measured a tarball ~5 MB smaller than the real one.
  • Removed ALLOWED_TEST_LIKE; added /\.test-d\.ts$/, /\.testkit\.ts$/, /__snapshots__\//, /__cassettes__\// and /^apps\/agent-forge\/dist-server\/.*\.map$/ to FORBIDDEN_PATHS.
  • Added REQUIRED_PATHS: the tarball must contain src/index.ts, src/deploy/runtime.worker.ts, src/deploy/shims/node.worker.ts (the Worker/node-server bundles read them via src/deploy/bundle.ts) and apps/agent-forge/dist-server/index.cjs, apps/agent-forge/dist/index.html (lousho studio).
  • Thresholds reset from the measured tarball with ~20% headroom: MAX_ENTRIES 900 → 1050 (measured 873), MAX_UNPACKED_BYTES stays 16 MiB (measured 13.5 MiB), MAX_PACKED_BYTES stays 4.5 MiB (measured 3.65 MiB).
• CHANGELOG.md: entry under ## [Unreleased] → Changed. No docs state the package size, so no docs changes; npm run docs:llms:check passes.

Measured tarball (npm pack --dry-run --json, after npm run build + npm run build:studio)

	before	after
entries	902	873
unpacked	21,841,432 B (20.8 MiB)	14,123,313 B (13.5 MiB)
packed	5,856,190 B (5.6 MiB)	3,826,273 B (3.65 MiB)

(dist/**/*.map alone: 8,040,032 B → 2,699,298 B.) For reference, the 1.0.0-alpha.8 baseline cited in #191 was 720 files / 16.5 MB / 4.4 MB — this also lands under it. The pack-smoke unpacked cap of 16 MiB now has ~2.5 MiB of headroom instead of the 45 KB that triggered #316.

None of the 15 test-only files (nor the newer *.test-d.ts/*.testkit.ts files added since alpha.8) ship; src/testing/* and the cassettes' runtime reader src/testing/recordReplay.ts still do.

Checks

• npm run pack-smoke: passes — 873 entries, 13.5 MB unpacked, 3.6 MB packed, publish dry-run ok, ESM+CJS loads, lousho --help/doctor, tsc bundler+node16, create-lousho-agent --help.
• Negative test: removing !src/**/*.test-d.ts from files makes pack-smoke fail with 17 tarball contains forbidden file src/**.test-d.ts errors (then reverted).
• npm run test:coverage: 295 test files passed, 1 skipped.
• npx tsc --noEmit: clean. npm run lint: clean. npm run test:types: 17 files / 79 tests, no type errors.
• npm run fallow: fails with dead-code (10 issues), dupes (5 clone groups), health (6 above threshold) — identical failure on main's CI (e.g. run 37184342607), pre-existing and unrelated to this diff (no src/ changes).

Functional proof (issue item 4)

Installed the packed tarball in a fresh project (npm install <tarball> tsup wrangler ai zod @ai-sdk/openai @ai-sdk/anthropic @modelcontextprotocol/sdk) with a yaml spec (provider: { type: mock }, tools: [current-date]):

$ npx lousho build --target=cloudflare-worker --agent=agent.yaml
wrangler deploy (bundle: 3.49 MB raw / 656.8 KB gzip, within the 64.00 MB limit)

lousho studio also works from the installed package (R1a is merged):

$ npx lousho studio --port 4319
[lousho studio] starting production server (port 4319)...
[lousho studio] Agent Forge: http://127.0.0.1:4319
[lousho studio] API server listening on http://127.0.0.1:4319
$ curl http://127.0.0.1:4319/   → HTTP 200, serves the Agent Forge index.html