Improve diffbudget package trust metadata

[rogerchappel]

What changed

• Added npm package trust metadata for repository, issues, homepage, and author provenance.
• Documented local verification commands in the README when they were not already visible.

Why it matters

These fields make the package easier to inspect from npm/GitHub and give users a copy-pasteable way to verify changes before release or packaging work.

Verification

• package json parse: pass; npm pack --dry-run: pass

Limitations / follow-up

• This pass does not change runtime behavior; deeper fixture-backed CLI tests remain good follow-up work.