fix(release): ship a .distignore so release:zip packs only the plugin

[AnuragVasanwala]

What this PR does

Ships a .distignore, so npm run release:zip packs only what the plugin needs at runtime. Found in a security review.

Why

release:zip packs the working tree as it is on disk, never reads .gitignore, and without a .distignore leaves out only .git/, dist/, tests/, node_modules/, bin/, .github/, *.config.js and package-lock.json. A real run produced 5,551 files (94 MB), including .env.local, .claude/, docs/ (with docs/internal), src/, graphify-out/, scripts/ and the lint and test configs. On a server those files sit inside the web-readable plugins directory.

Changes

• .distignore: the list docs/local-development.md already recommends. It leaves out dotfiles (including .env.local and .wp-env.override.json), bin/, coverage/, docs/, graphify-out/, node_modules/, scripts/, src/, tests/, build and lint configs, the AI and contributor docs, composer.lock and the npm manifests.
• docs/local-development.md: says the .distignore now ships, instead of "the skeleton ships none".
• .gitignore: adds /dist/, where release:zip writes the zip, so a release build cannot be committed by accident.

How I verified

Following the documented release steps (composer install --no-dev --optimize-autoloader, npm run build:prod, npm run release:zip), with a test .env.local present:

• The zip has 123 files (145 KB): the main plugin file, inc/, templates/, languages/, assets/build/, the no-dev vendor/, composer.json, README.md, CHANGELOG.md and LICENSE.md.
• No .env*, .claude/, docs/, src/, tests/, graphify-out/, lock files, PHPUnit or PHPCS in the zip.
• Installed into a clean WordPress 7.1 on PHP 8.2 from the zip: the plugin activates, all three example blocks register, and the home page returns 200 with WP_DEBUG on and no PHP errors or warnings.

composer install --no-dev is still a manual step before zipping, as the docs describe; release:zip warns when the zip is large because dev packages are present.