fix: strip package.json from zip and document HTTP local-dev setup

[louwie17]

Summary

• package.json in zip: npm-packlist always bundles package.json when a files field is present — it's an invariant of how the tool works, not a wp-scripts bug. Fix is a post-build zip -d in the plugin-zip script to strip it before the file is used anywhere.
• README — insecure transport: replaces the bare filter name with the actual mu-plugin one-liner so a fresh contributor knows exactly what to add. Cross-links the step-3 mention to the local development section.

Changes

package.json

- "plugin-zip": "wp-scripts plugin-zip"
+ "plugin-zip": "wp-scripts plugin-zip && zip -d hey-woo.zip hey-woo/package.json"

README.md — local development section:

- # Or hit MCP directly (requires HTTPS in production; local dev uses
- # the woocommerce_mcp_allow_insecure_transport filter via a mu-plugin):
+ # MCP requires HTTPS by default. For local HTTP, add a mu-plugin:
+ echo '<?php add_filter( "woocommerce_mcp_allow_insecure_transport", "__return_true" );' \
+   | npx @wordpress/env run cli -- bash -c "cat > /var/www/html/wp-content/mu-plugins/allow-http-mcp.php"
+
+ # Then test the endpoint:

Verified locally

$ npm run plugin-zip
...
deleting: hey-woo/package.json

$ unzip -l hey-woo.zip | grep -E "package|LICENSE|README|hey-woo.php"
  hey-woo/hey-woo.php
  hey-woo/LICENSE
  hey-woo/README.md

🤖 Generated with Claude Code