build(release): make the release set publishable under the private scope

Every package under packages/, apps/, and vendor/ drops "private": true and
declares publishConfig.access "restricted": the repository now states which
packages it publishes instead of deciding it at publish time. Each one also
declares its repository and directory, which is how a consumer of a private
package reaches its source.

The Landlock packages move to restricted with them. They have never been
published, so nothing anonymous depends on them today, and the whole
@deepseek-ai scope stays private.

The workspace constraint that required every package to be private now applies
to non-members only, and asserts the publishable trio on each release member.

native/landlock-run/packages/entry/package.json

@@ -32,7 +32,7 @@
   },
   "license": "BSD-3-Clause",
   "publishConfig": {
-    "access": "public"
+    "access": "restricted"
   },
   "optionalDependencies": {
     "@deepseek-ai/node-addon-landlock-run-linux-arm64": "workspace:*",

native/landlock-run/packages/linux-arm64/package.json

@@ -26,6 +26,6 @@
   },
   "license": "BSD-3-Clause",
   "publishConfig": {
-    "access": "public"
+    "access": "restricted"
   }
 }

native/landlock-run/packages/linux-x64/package.json

@@ -26,6 +26,6 @@
   },
   "license": "BSD-3-Clause",
   "publishConfig": {
-    "access": "public"
+    "access": "restricted"
   }
 }