fix(pack): exclude existing package.json from assets - #36507

Checked package_dir resolves to package.config_file.dir_path(), the actual source root, so package_dir.join("package.json") is exactly the path a hand-written package.json sitting next to deno.json would have, and exactly where the generated one gets written too. Before this, only the config file itself (deno.json) was excluded from the generic asset-collection pass, so an existing package.json in the source tree would get swept up as a regular asset and end up in the tarball alongside the generated one under the same path, a real duplicate-entry problem, not just wasted bytes.

Good that this is scoped to package_dir.join("package.json") specifically rather than excluding package.json anywhere in the tree, a nested one inside a subdirectory (a bundled sub-package, say) is a different file and has no reason to be swept up by this exclusion.

The test change checking grep -c '^package/package.json$' equals exactly 1 in the resulting tarball is the right assertion, it directly verifies the duplicate is gone rather than just checking the command exits successfully, and the 0 assets collected expectation confirms the source package.json is no longer being counted as a collected asset at all.

Right fix for #36387. A tar with two package/package.json members of differing content is genuinely broken — which one you get depends on the extractor, and npm/tar take last-wins, so the source file was silently overriding the generated manifest for consumers.

The existing exclusion only covered package.config_file.specifier, which is deno.json in the case that regressed; adding the explicit root package.json covers the sibling case and is a no-op when the config file already is package.json. Scoping it to package_dir.join(...) rather than any package.json is right too — nested ones don't collide and should still ship.

The test is better than it needs to be: 0 assets collected pins that the file isn't merely deduplicated later but never collected, and grep -c '^package/package.json$' catches a regression that a cat of the extracted file would sail straight past.

The test node_compat failure is test-cluster-concurrent-disconnect.js, unrelated to pack.

One thing for a follow-up issue rather than this PR: silently dropping the source package.json means any fields in it that the generated manifest doesn't reproduce (custom scripts, engines, and so on) vanish from the published tarball without a word. Strictly better than shipping two conflicting files, but a note in the pack output — or merging unknown fields — might be worth considering. LGTM.