Add repo hygiene gates: knip, publint, yarn constraints

knip (workspace-aware config) fails on unused files, exports, and
dependencies in our code — vendor/ excluded, duplicate default+named
exports allowed (intentional API shape). publint checks every
packages/* package.json for publishing correctness (scripts/
publint-all.ts). Yarn constraints (yarn.config.cjs) mechanize the
AGENTS.md package rules: everything private, dsh-* packages declare
cordis as matching peer+dev dependency, uniform 0.0.1 version, ESM.

yarn hygiene runs all three.

package.json

@@ -18,14 +18,20 @@
     "lint:fix": "eslint . --fix",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
+    "knip": "knip",
+    "publint": "tsx scripts/publint-all.ts",
+    "hygiene": "yarn knip && yarn publint && yarn constraints",
     "demo": "node --expose-internals --import tsx examples/echo-agent/start.ts"
   },
   "devDependencies": {
     "@stylistic/eslint-plugin": "^5.10.0",
     "@types/node": "^25.3.5",
     "@vitest/coverage-v8": "^4.1.8",
+    "@yarnpkg/types": "^4.0.1",
     "dumble": "^0.2.3",
     "eslint": "^10.4.1",
+    "knip": "^6.16.1",
+    "publint": "^0.3.21",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.61.0",