fix(scripts): the changeset level axis reads a packed bin target as a published surface (#16988)

`judgeLevel` decided a package was "grown" from `packages/*/src/**` alone, so a
diff confined to a package's `bin` target -- which npm packs REGARDLESS of
`files` -- was invisible to it. The same `Clause-② yes` + `patch` pairing went
red over `src/**` and green over `bin/**` on the same day, and the green was
read as "the axis looked and approved" when it meant "the axis did not look".

`publishedSourceOwners` becomes a two-legged reading:

  1. compiled source -- the path reads `<dir>/src/**`. Shape only, byte for byte
     the leg that already existed, and deliberately NOT rewritten to ask "is
     this in the packed set?": `files` is `["dist", ...]`, so such a predicate
     would stop counting `src/**` and gut the axis while printing ticks.
  2. a packed `bin` target -- the directory's own manifest names the path in
     `bin`, in either spelling npm accepts. Manifest-derived rather than a list
     of root names, so a `bin` pointing outside `bin/` is read and a file beside
     the target that `bin` does not name is not.

The manifest reader is a REQUIRED argument: a default would silently read
`src/**` alone at a call site that reads as if it asked the whole question. A
manifest that is present and will not parse makes its directory a candidate that
cannot be named, so the path lands in `unreadable` rather than in neither set.

Superset-only, measured over the whole tree: 73 package dirs matched before, 73
after, 0 lost; 5303 paths resolved before, 5305 after, 0 lost, the two gained
being the repository's only two real bin targets.


Claude-Session: https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU

Co-authored-by: Claude <noreply@anthropic.com>

Author: baozhoutao