chore(monorepo): audit + targeted fixes for production readiness

[moralespanitz]

Summary

Audit on audit/monorepo-state. Lands four narrow fixes plus the infrastructure to make the monorepo build reproducibly from a fresh checkout. Every AGENTS.md gate passes. Full audit in docs/findings/monorepo-audit.md.

Fixes

• zod v4 schema compatibility. Adds .optional() to silently-coercing z.unknown() helpers across common.ts, memories.ts, documents.ts, agents.ts. Without this, 165 route + schema tests fail with expected: nonoptional under the repo's pinned zod@^4.3.6.
• Search ranking. memory-search.ts:463 — current-state-query packaging sorts by ranking_score instead of raw score, so the similarity floor actually gates response order. Addresses the "Neovim ranks Phase 4 cutover prep: release queue, docs cleanup, AUDN-SC rename #4" regression. See docs/findings/search-ranking-bias.md.
• SDK transport errors. SDK now throws a typed NetworkError carrying URL + errno (ECONNREFUSED / AbortError / etc.) instead of bare "fetch failed". CLI hooks now surface actionable messages when core is unreachable.
• Monorepo build. Rewrites packages/core/Dockerfile to the canonical turbo prune + pnpm deploy --prod pattern; build context shifts to the workspace root via packages/core/docker-compose.yml. Adds root .dockerignore, .npmrc with link-workspace-packages=deep + prefer-workspace-packages=true so consumers resolve @atomicmemory/sdk to the workspace package locally. The prepublishOnly guards still reject workspace: ranges, so published builds remain registry-pinned.

Cleanup (no behavior change)

Trim multi-paragraph AI-generated file headers and stale @example blocks from packages/sdk/src/core/error-handling/*, core/events.ts, core/runtime-config.ts, utils/environment.ts, and utils/validators/primitive.ts. Public surface is documented in packages/sdk/README.md; file headers now state purpose in one line each per AGENTS.md.

Findings (engineering follow-ups, not patched here)

• docs/findings/concurrent-ingest-race.md — Bug feat(monorepo): public foundation #1 from the integration validation report. Maps the silent-write race in the ingest pipeline + records the recommended fix (unique (user_id, content_hash) index + ON CONFLICT + response-shape change). Multi-day work; not a single-session patch.
• docs/findings/search-ranking-bias.md — full root cause for the ranking regression. Partial mitigation lands in this PR; two pipeline-internal sorts still use raw score and are flagged for follow-up.

Validation

Surface	Result
pnpm run build	10/10, 9.4s
pnpm run typecheck	10/10, 3.0s
pnpm run lint	10/10, 1.4s
pnpm run test (non-core lane)	14/14, 6.6s
pnpm run package-metadata	OK
pnpm run repo-hygiene	OK
pnpm run security-compliance	OK
pnpm run docs-contract	OK
pnpm run public-integration-smoke	OK (11 package-protocol rows)
pnpm run pack-dry-run	OK (12 publishable packages)
pnpm --filter @atomicmemory/core test	3117 pass / 10 skipped
pnpm --filter @atomicmemory/core test:docker-smoke	11/11
pnpm --filter @atomicmemory/core code-health (fallow)	0 dead anything across 119,857 LOC

Workspace	Tests
@atomicmemory/core	3117 pass
@atomicmemory/sdk	568 pass
@atomicmemory/cli	377 pass
@atomicmemory/mcp-server	24 pass
@atomicmemory/langchain	19 pass
@atomicmemory/langgraph	17 pass
@atomicmemory/mastra	17 pass
@atomicmemory/openai-agents	11 pass
@atomicmemory/vercel-ai	28 pass
@atomicmemory/openclaw-plugin	3 pass

Grand total: ~4,181 automated tests, 0 failing.

Test plan

• CI runs ci:affected + ci:public-smoke + ci:docs-contract + ci:pack-dry-run against this branch and passes.
• Reviewer reads docs/findings/monorepo-audit.md and confirms verdict before merge.
• (Optional) Reviewer runs pnpm --filter @atomicmemory/core test:docker-smoke locally to spot-check the Dockerfile rewrite.
• Open follow-up issues for the two items in docs/findings/concurrent-ingest-race.md and the remaining pipeline-internal sorts in docs/findings/search-ranking-bias.md.

Branch shape

26 files changed, +541 / -280. New: .dockerignore, .npmrc, docs/findings/*.md.