fix(packaging): include auth/ and operator/ in published tarball (2.7.2)

[Sentinel-Bluebuilder]

What

Fix the 2.7.1 packaging regression: auth/ and operator/ were missing from the published tarball, so every npm install blue-js-sdk@2.7.1 failed with ERR_MODULE_NOT_FOUND.

Why this slipped through

package.json "files" listed chain/, connection/, protocol/, etc., but not auth/ or operator/. The CI "Verify all imports resolve" step walked the source tree and resolved every from './...' against the on-disk directories — which all existed. The actual published tarball was never installed and imported in CI, so the gap between source and published surface was invisible.

Plan Manager surfaced it during the 2.7.0 → 2.7.1 upgrade attempt:

Error [ERR_MODULE_NOT_FOUND]: Cannot find module
  '<...>\node_modules\blue-js-sdk\auth\adr36.js'
imported from <...>\node_modules\blue-js-sdk\index.js

After patching auth/, a clean-room verify revealed the same failure on operator/auto-lease.js. So it's not a one-off — it's a category of bug.

Fix

File	Change
package.json	Add \"auth/\" and \"operator/\" to \"files\"; bump to 2.7.2
.github/workflows/ci.yml	New step: Verify published tarball imports cleanly. npm pack → install tarball in mktemp -d → import('blue-js-sdk') and assert ≥100 exports. This is the only test that exercises the actual published surface
CHANGELOG.md	Document the regression and the new rule

Rule going forward

Every directory imported by index.js MUST appear in package.json "files".
Local-import checks cannot enforce this — they pass against the source tree even when the publish manifest omits a directory. The tarball-install CI step is the gate.

Verification

Locally, in a clean temp dir, against the patched tarball:

```
npm install ./blue-js-sdk-2.7.2.tgz
node -e "import('blue-js-sdk').then(m => console.log(Object.keys(m).length))"
→ 401
```

The new CI step runs the same sequence on every PR.

Consumer-side context

• Plan Manager (Desktop/plans) attempted to bump to 2.7.1 to remove its runtime RPC-patch shim. Bump reverted to 2.7.0 after the install error. After 2.7.2 ships, Plan Manager will retry the bump and drop the patch.
• Any other consumer that ran npm install blue-js-sdk@2.7.1 after publish hit the same ERR_MODULE_NOT_FOUND.