package: generated version module bundles full package metadata despite version-only claim

[goanpeca]

Area: packaging / bundle metadata (src/version.ts, generated dist/package.json.js)

The audit found a mismatch between the changelog and generated build output. The changelog says the Rollup JSON import is tree-shaken down to version-only metadata, but the built dist/version.js imports dist/package.json.js, and that generated file contains the full package metadata, including scripts and devDependencies.

Impact: browser or edge consumers can receive unnecessary package metadata in the published bundle. The shipped artifact also contradicts the release notes, making it harder to trust package-size and metadata claims.

Acceptance criteria:

• Generate or inject a version-only module so VERSION does not pull full package.json metadata into dist.
• Add a package verification check that fails if generated dist/package.json.js contains scripts, devDependencies, or unrelated package metadata.
• Update the changelog or docs if full package metadata is intentionally shipped.
• Re-run pnpm run build and package verification.

Source: production-readiness audit.