fix: release-please tag lookup and trim published npm package

[pablaber]

Summary

• release-please-config.json: set include-component-in-tag: false and last-release-sha to the v0.3.2 commit so release-please finds the existing bare vX.Y.Z tags instead of treating this as a new component and starting over at 0.1.0 (fixes the runaway PR chore(main): release 0.3.3 #31).
• package.json: added a files allowlist (dist, CHANGELOG.md) so npm publishes only the compiled output and changelog instead of leaking source .ts, CI configs, and dev tooling — published tarball drops from ~42 files / 117 KB to ~25 files / 58 KB.

Test plan

• Merge and confirm release-please opens a PR titled chore(main): release 0.3.3 containing only the fix: from fix: nullable arrays + node 24 + dev workflow docs #30.
• On merge of that release PR, confirm v0.3.3 is tagged and openapi-typescript-types@0.3.3 appears on npm with dist/ only.