Ship src/ or drop source maps from the published tarball #22

Follow-up from #13 (PR #21). Pre-existing — not caused by that change.

tsconfig.build.json emits .js.map and .d.ts.map, and files ships dist, but not src. So every published source map has a sources entry pointing at ../src/*.ts, which is not in the tarball.

Consequences for consumers:

• declarationMap go-to-definition lands on nothing — the feature the maps exist for does not work.
• Debuggers and stack-trace tooling resolve the maps, fail to find the sources, and fall back silently.

Two clean options, either acceptable:

1. Ship the sources — add "src" to the files allowlist. Larger tarball, working go-to-definition and debugging.
2. Drop the maps — turn off sourceMap / declarationMap in tsconfig.build.json. Smallest tarball, no dangling references.

Shipping maps without sources is the one combination that is strictly worse than either.

Tasks

• Pick an option and apply it.
• Verify against a packed tarball (pnpm pack) installed into a throwaway consumer, not just the config — confirm go-to-definition resolves (option 1) or that no .map files ship (option 2).
• publint/attw already run in CI via pnpm check:package; confirm whichever option you take stays green.

Relates to #7 (first publish).