Complete package metadata and backup ignores

[ashfame]

Change

Add private npm package identity/version metadata, an accurate Composer description, and root-only ignores for the SQL backups produced by the existing development scripts.

Root cause

The package manifests lacked basic repository identity metadata, the lockfile retained an accidental worktree-derived name, and generated root database backups were not ignored.

Affected alerts

No baseline alert is assigned to this metadata-only child.

Impact

The private npm package is consistently identified as try-wordpress version 0.0.1, Composer describes the product accurately, and only backup.sql plus backup-*.sql at the repository root are ignored. Existing license metadata is preserved exactly.

Checks

• npm/package-lock identity and normalized lock comparison
• JSON and strict Composer validation
• Composer locked audit
• npm audit baseline reconciliation
• Root-only gitignore behavior probes
• Approved plan prefix and 124-row appendix verification
• git diff --check
• Independent review: approved