fix: emit relative imports in dist (drop self-referential @/ alias)

[Isonimus]

The bug

@tindalabs/shield's published dist/otel.js imported its internal path alias:

import { ContentProtector } from '@/core/index.js';

tsc does not rewrite paths aliases (@/* → src/*) to relative paths on emit, so the alias leaked into the shipped package. Any consumer bundling shield without replicating that alias — Webpack/Next, Vite, esbuild, etc. — fails on import of attachShieldToSpan:

Module not found: Can't resolve '@/core/index.js'

This breaks the OTel entry point for the common bundler case. (assess() / ContentProtector happen not to traverse otel.ts, which is why it wasn't caught earlier.)

The fix

src/otel.ts was the only file using the alias. It now imports relatively:

import { ContentProtector } from './core/index.js';
import type { ContentProtectionOptions, CustomEventHandlers } from './types/index.js';

So dist/ is alias-free with no new build tooling.

Verification

• Clean tsc build; grep "from '@/'" dist → nothing.
• dist/otel.js now imports ./core/index.js.
• Full suite green: 371 passed, 1 skipped (372).

Surfaced while wiring shield into the tindalabs.dev static build (Next/Webpack), where it was a hard build failure. CHANGELOG updated — this is a consumer-visible fix, so it warrants a 0.1.1 patch.

Optional hardening (not in this PR): add tsc-alias to the build, or a lint rule banning @/ in src/, to prevent recurrence if the alias is reintroduced.