fix: guard publish against a half-built dist

The build is `tsup && tsc`. tsup runs with clean:true, so it wipes dist and
writes JavaScript; if tsc then fails, dist holds .js with no declarations. The
build exits non-zero, but packages/core declared no prepublishOnly, so nothing
rebuilt at publish time and a later npm publish would ship it.

Reproduced: remove the declarations from a copy of dist and npm pack --dry-run
still succeeds, with all 41 exports subpaths pointing at files absent from the
tarball. npm pack was never the guard.

Adds prepublishOnly (build then verify) and scripts/verify-dist.mjs, which
asserts every exports target exists. CI runs verify-dist as well, so the guard
is exercised on every push rather than only on the rare publish.

.github/workflows/ci.yml

@@ -35,6 +35,9 @@ jobs:
       - name: Build core
         run: npm run build --workspace=@codeburn/core
 
+      - name: Verify every export target exists
+        run: npm run verify-dist --workspace=@codeburn/core
+
       - name: Verify package contents
         run: npm pack --workspace=@codeburn/core --dry-run