chore: add a package-size check to release validation

[afurm]

The npm package should stay small because users install it through npx draftmora. We currently run npm pack --dry-run, but there is no budget or check that fails when runtime assets grow unexpectedly.

Scope:

• Add a lightweight package-size budget script or CI check around npm pack --dry-run --json.
• Keep README-only assets out of runtime package contents.
• Document the budget in CONTRIBUTING.md if a new command is added.

Acceptance criteria:

• CI or a documented local command reports the packed size and file list.
• The check catches accidental inclusion of databases, memory files, screenshots, or large docs-only assets.
• Existing npm audit, npm run typecheck, npm test, npm run build, and npm pack --dry-run still pass.