fix: correct bin path and set public access for npm publish

The bin path had a leading './', which npm's publish validation
silently strips rather than fixing — 'shopify-mcp' was being dropped
from the published package entirely, breaking npx. Also set
publishConfig.access so a bare 'npm publish' can't default to
restricted access on this scoped package.