build(publish): fix v2 single-package bundle and add pack:verify

Prepare the single `@modelcontextprotocol/inspector` tarball for publishing
and add a script that verifies the real published package end to end.

- Add `scripts/pack-and-verify.mjs` (`npm run pack:verify`): build, `npm pack`,
  install the tarball into a clean consumer, and drive the installed
  `mcp-inspector` bin (web/cli/tui) — catching "works in --dev, breaks under
  npx" packaging/path failures the in-repo smokes miss. Local/release tool
  (install needs network), not wired into the fast validate/ci loop.
- Disable source maps in the cli/tui/web-runner tsup configs (~halves the
  unpacked payload; runtime doesn't need them).
- Add `clients/web/.npmignore` so `clients/web/build` (prod web-server runner)
  ships — npm's packlist was honoring the nested `.gitignore` `build/` entry
  over the root "files" allowlist, dropping the runner while `dist/` slipped
  through.
- Ship `clients/cli/package.json` and `clients/tui/package.json`: both bundles
  read their own package.json at runtime (CLI client identity, TUI header), so
  the installed CLI crashed on connect and the installed TUI crashed on launch
  without them.

Document the packaging invariants and pack:verify in the launcher README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw

clients/web/.npmignore

@@ -0,0 +1,19 @@
+# npm's packlist uses THIS file instead of .gitignore when deciding what to
+# publish from clients/web. It exists to fix a packaging bug: .gitignore here
+# lists `build/` (a git artifact we never commit), and npm honored that
+# exclusion even though the root package.json "files" field explicitly lists
+# `clients/web/build`. The result was the prod web-server runner silently
+# missing from the published @modelcontextprotocol/inspector tarball while
+# `clients/web/dist` slipped through — so `mcp-inspector --web` had no server to
+# load. (The other clients don't hit this because none of them ship a nested
+# .gitignore.)
+#
+# Crucially this file does NOT list `build` or `dist`, so both the prod runner
+# (build/) and the SPA (dist/) are packed. The root "files" allowlist already
+# restricts publishing to those two directories, so everything else in
+# clients/web (src, configs, node_modules, coverage, storybook-static) stays out
+# regardless — the entries below are just belt-and-suspenders.
+node_modules
+coverage
+storybook-static
+dist-ssr

clients/web/tsup.runner.config.ts

@@ -10,7 +10,9 @@ export default defineConfig({
   format: ['esm'],
   outDir: 'build',
   clean: true,
-  sourcemap: true,
+  // No source maps in the published bundle — they roughly double the on-disk
+  // size and aren't needed at runtime (debug via `npm run dev` on the source).
+  sourcemap: false,
   target: 'node22',
   platform: 'node',
   noExternal: [/^@inspector\/core/],