refactor: publish compiled ESM package artifacts

[ericjuta]

Summary

• adopt extensionless TypeScript authoring imports and native Vite+ vp pack compilation for all five code packages
• make ignored compiled dist/ output the package export/bin contract while preserving root-only ESM libraries, Bun-only tools, external dependencies, canonical host metadata, and deterministic artifact assembly
• verify clean Bun and Node 24 consumers, embedded source-mapped TypeScript, package/public boundaries, and aligned fork-safe CI and documentation

Verification

• bun run audit
• bun run fmt:check
• bun run lint
• bun run typecheck
• bun run effect-tsgo:diagnostics
• bun run check
• bun run test — 14 files, 117 tests
• bun run check:target-conformance
• bun run artifacts
• bun run verify:artifacts
• bun run check:public-boundary
• bun run smoke:install
• repeated clean vp pack builds produced identical 30-file path/hash manifests
• clean-output bun run eval:replay -- ... rebuilt the package graph and wrote the sanitized replay report
• omp-reviewer --base origin/main completed with no findings

The artifact packer rebuilds all package outputs inside the immutable source-commit snapshot, byte-compares the live ignored outputs, and stages only snapshot-built bytes. The verifier proves five package archives, five host archives, one skills candidate, four bounded receipts, exact Node 24 tarball imports, an embedded-TypeScript source-mapped frame without raw source installed, and the absence of raw TypeScript, host paths, private material, CommonJS fallbacks, bundled declared dependencies, and stale source exports.

No package was published, tagged, released, deployed, installed, or submitted to an OpenAI portal.

Closes #11
Closes #18

[ericjuta]

Final implementation report for the compiled ESM migration:

• Head: d1da634721a50070829febcde2d200126f816de4
• Local Bun 1.4.0 / Node 24.7.0 contract passed: audit, fmt:check, lint, typecheck, effect-tsgo:diagnostics (59 files, 0 diagnostics), check, test (14 files, 117 tests), target conformance, artifact assembly/verification, public-boundary verification, and clean package installation.
• Compiled eval smoke rebuilt all five packages and wrote the sanitized replay report.
• Artifact proof covers five package archives, five host archives, one skills candidate, four bounded receipts, exact packed Node 24 consumers, embedded TypeScript source-map resolution, and source-commit-bound package staging.
• Attested omp-reviewer --base origin/main returned no findings (patch is correct, confidence 0.87).
• GitHub CI and CodeQL passed for the PR head; the PR reports a clean merge state.
• No generated dist output is tracked. Nothing was merged, published, tagged, released, deployed, installed as a skill, or submitted to an OpenAI portal.