fix(cli): package spec for CLI command

[juliosuas]

Fixes #153.

What changed

Copy docs/spec.md to both bundle entry-point directories during the CLI build. The linter entry point continues to resolve dist/linter/spec.md, while the CLI entry point can now resolve dist/spec.md as expected by getSpecContent().

Verification

• Reproduced the failure on main: package check feat: foundational infrastructure for CSS Custom Properties export #20 reported CLI spec command failed to load spec.md.
• bun run check-package — 25 passed, 0 failed.
• bun test — 282 passed, 1 skipped, 0 failed.
• bun run lint — passed.
• git diff --check — passed.

This PR does not change .github/workflows. Org-level zizmor can still fail on pre-existing unpinned actions in test.yml; that is outside the scope of #153.

[juliosuas]

Keeping this PR in scope of the #153 spec packaging fix (packages/cli/package.json only). I reverted the workflow/CI commits that hash-pinned actions/checkout, oven-sh/setup-bun, and actions/setup-node, added permissions: {}, and set persist-credentials: false.

Org-level zizmor (zizmor-output) fails on pre-existing unpinned actions in the repo's test.yml; that finding is not introduced by this diff. I am not expanding the PR to pin or rewrite CI.

[juliosuas]

Accidentally closed when the source fork was deleted during a profile cleanup. Same commits restored here: #175