fix(package): block internal-only assets from publish payload

Validator finding #12 from the publish-debate-vortex hyperultradebate flagged that internal-only skill and command assets could leak into the npm payload once the dot asset roots are included.

Bun 1.3.x ignores a root .npmignore for directories listed in package.json#files, so the exclusion rules live in nested .npmignore files co-located with each published command and skill directory.

RED before nested ignores: bun test script/package-layout-exclusion.test.ts failed with expect(received).toEqual(expected), receiving .opencode/skills/__internal-fake-do-not-ship-test-artifact/SKILL.md, .agents/skills/__internal-fake-do-not-ship-test-artifact/SKILL.md, .opencode/command/__internal-fake-do-not-ship-test-artifact.md, and .agents/command/__internal-fake-do-not-ship-test-artifact.md instead of [].

GREEN after nested ignores: bun test script/package-layout-exclusion.test.ts reported 2 pass, 0 fail, 5 expect() calls.

This is the exclusion companion to script/package-layout.test.ts, the inclusion test arriving through the dev merge.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.opencode/command/.npmignore

@@ -0,0 +1,10 @@
+# Internal-only assets — never ship to npm registry.
+# See script/package-layout-exclusion.test.ts for the enforcing guard.
+# Root .npmignore does not work for directories listed in package.json#files
+# under Bun 1.3.x, so the guard lives co-located with the published content.
+__*/
+__*.md
+.private/
+.draft/
+.private.md
+.draft.md

.opencode/skills/.npmignore

@@ -0,0 +1,10 @@
+# Internal-only assets — never ship to npm registry.
+# See script/package-layout-exclusion.test.ts for the enforcing guard.
+# Root .npmignore does not work for directories listed in package.json#files
+# under Bun 1.3.x, so the guard lives co-located with the published content.
+__*/
+__*.md
+.private/
+.draft/
+.private.md
+.draft.md