package.json: be more explicit with the files we include.

I noticed that the v4.1.3 npm tar had .DS_Store files in it; this should fix it.