fix bug: files under src-folder with names starting with .. ( e.g., dist/..foo.js )
are wrongly treated as outside src-folder and not rebased when publishing.
fix bug: publish rewrites paths outside src-folder ( e.g., ./src/... when
publishing dist ) into broken ../ paths — now only paths under src-folder
are rebased; others are kept as is. also handle string-form bin.
fix bug: object-form entries ( {name, dir, ...} ) in frontendDependencies.modules
are not recognized by -l dedup check, causing the module to be processed twice
( second pass without dir overwrites the correct symlink with package root )