Improve typegap release trust and verification

[rogerchappel]

What changed

• Added npm package trust metadata and/or package support-file coverage where missing.
• Documented the existing local verification commands in the README when they were not discoverable.
• Added CI coverage for containerghost when applicable.

Why it matters

These changes make the package easier to audit from npm/GitHub, help contributors run the same checks before PRs, and reduce release-readiness surprises.

Verification

• node package.json parse: pass
• npm pack --dry-run: pass

Remaining limitations

• No package was published and no release was tagged.