fix: include npm-shrinkwrap.json in published package (#90)

* fix: include npm-shrinkwrap.json in published package

Add npm-shrinkwrap.json to the files field in package.json so it is
included in the npm tarball. Also add it to .releaserc git assets so
semantic-release commits the updated version on each release.

Closes #89

* fix: update lodash to 4.18.1 to resolve known vulnerabilities

Run npm audit fix to bump lodash from 4.17.23 to 4.18.1, resolving
GHSA-r5fr-rjxr-66jc (Code Injection) and GHSA-f23m-r3pf-42rh
(Prototype Pollution).

Author: pchuri

.releaserc

@@ -9,7 +9,7 @@
     [
       "@semantic-release/git",
       {
-        "assets": ["package.json", "CHANGELOG.md"],
+        "assets": ["package.json", "npm-shrinkwrap.json", "CHANGELOG.md"],
         "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
       }
     ]

npm-shrinkwrap.json

@@ -58,6 +58,7 @@
   "files": [
     "bin/",
     "lib/",
-    ".claude/skills/"
+    ".claude/skills/",
+    "npm-shrinkwrap.json"
   ]
 }