build(release): publish the dsh family publicly

Every release member now declares publishConfig.access: public, so the scope no
longer mixes levels: the 221 packages/*/* and apps/* manifests join the vendored
framework and the native packages.

check-workspace-constraints drops the per-sequence expectation and holds every
release member to public, which is what stops a member from drifting back.

Access is a property of the package, not of a version: the dsh packages already
published as restricted become world-readable at their next publication.

packages/boot/app-boot/package.json

@@ -3,7 +3,7 @@
   "description": "Shared boot glue for the app bins: .env loading, fail-loud Loader guards, snapshot-aware config resolution, and the Loader boot sequence",
   "version": "0.1.0-rc.3",
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "repository": {
     "type": "git",

packages/boot/cmdline/package.json

@@ -3,7 +3,7 @@
   "description": "Immutable command-line handoff from a dsh launcher to any app plugin that injects cmdlineArgs",
   "version": "0.1.0-rc.3",
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "repository": {
     "type": "git",