v2 single-package publish bundle correctness + pack:verify

[cliffhall]

Summary

The packaging-correctness half of the v2 publish pipeline (parent tracking: #1636): make the single @modelcontextprotocol/inspector tarball correct and installable, and add a script that verifies the real published package end to end. This is distinct from the main.yml release-job wiring (#1640) — it's the "what ships and is it right" half, not the "how CI publishes it" half.

Scope (delivered)

• Single package, single version. One @modelcontextprotocol/inspector tarball bundling launcher + web + cli + tui; version single-sourced from the root package.json (the per-client manifests carry no version), read via a shared readInspectorVersion() in core/node/version.ts.
• Source maps dropped from the published bundle (~half the unpacked size).
• clients/web/build packaging fix — npm's packlist was honoring the nested .gitignore over the root "files" allowlist and silently dropping the prod web-server runner; fixed with a clients/web/.npmignore.
• npm run pack:verify — builds, npm packs the publishable tarball, installs it into a clean throwaway consumer, and drives the installed mcp-inspector bin (web/cli/tui) end to end, catching "works in --dev, breaks under npx" path/packaging failures. It caught two real bugs (CLI + TUI reading their own package.json at runtime).

Acceptance

• npm run pack:verify green: the published tarball installs clean and the real bin drives web + cli + tui.
• No source maps in the tarball; clients/web/{build,dist} present.
• Single source of truth for the version.

Delivered by PR #1637 (merged into v2/main).

[cliffhall]

Delivered by #1637 (merged into v2/main).