Add repo hygiene gates: knip, publint, yarn constraints

knip (workspace-aware config) fails on unused files, exports, and
dependencies in our code — vendor/ excluded, duplicate default+named
exports allowed (intentional API shape). publint checks every
packages/* package.json for publishing correctness (scripts/
publint-all.ts). Yarn constraints (yarn.config.cjs) mechanize the
AGENTS.md package rules: everything private, dsh-* packages declare
cordis as matching peer+dev dependency, uniform 0.0.1 version, ESM.

yarn hygiene runs all three.

knip.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://unpkg.com/knip@5/schema.json",
+  "exclude": ["duplicates"],
+  "ignoreWorkspaces": ["vendor/*"],
+  "workspaces": {
+    ".": {
+      "entry": ["examples/echo-agent/src/*.ts"],
+      "project": ["scripts/**/*.ts", "examples/**/*.ts"]
+    },
+    "packages/*": {
+      "entry": ["tests/**/*.spec.ts"],
+      "project": ["src/**/*.ts", "tests/**/*.ts"]
+    }
+  }
+}