Improve diffbudget release documentation

[rogerchappel]

What changed

• Added SECURITY.md to the npm package allowlist so the published tarball carries vulnerability reporting guidance.
• Documented the dbudget alias in the quickstart.
• Added npm run package:smoke and npm run release:check to README verification commands.

Why it matters

Users can discover both shipped CLI names and run the same release gates maintainers use before changing CLI behavior or publishing. The package dry run now confirms the security policy ships with the package.

Verification

• npm ci -> passed, 0 vulnerabilities
• npm run release:check -> passed; 10 tests passed, smoke ok, npm pack dry-run included SECURITY.md
• node /Users/roger/Developer/my-opensource/releasebox/bin/releasebox.js check . -> passed

Remaining limitations / follow-up

• No tag or publish was performed.
• Existing Dependabot PRs are separate and untouched.