Add repo hygiene gates: knip, publint, yarn constraints

knip (workspace-aware config) fails on unused files, exports, and
dependencies in our code — vendor/ excluded, duplicate default+named
exports allowed (intentional API shape). publint checks every
packages/* package.json for publishing correctness (scripts/
publint-all.ts). Yarn constraints (yarn.config.cjs) mechanize the
AGENTS.md package rules: everything private, dsh-* packages declare
cordis as matching peer+dev dependency, uniform 0.0.1 version, ESM.

yarn hygiene runs all three.

scripts/publint-all.ts

@@ -0,0 +1,18 @@
+import { execFileSync } from 'node:child_process'
+import { resolve } from 'node:path'
+
+// publint every publishable package (vendor/ is private upstream code and
+// examples/ are not packages; both are out of scope).
+const packages = [
+  'packages/llm',
+  'packages/session',
+  'packages/system-prompt',
+  'packages/tools',
+  'packages/agent',
+  'packages/agent-loop',
+]
+
+const root = resolve(import.meta.dirname, '..')
+for (const path of packages) {
+  execFileSync('node_modules/.bin/publint', [path], { cwd: root, stdio: 'inherit' })
+}