build(release): make the release set publishable under the private scope

Every package under packages/, apps/, and vendor/ drops "private": true and
declares publishConfig.access "restricted": the repository now states which
packages it publishes instead of deciding it at publish time. Each one also
declares its repository and directory, which is how a consumer of a private
package reaches its source.

The Landlock packages move to restricted with them. They have never been
published, so nothing anonymous depends on them today, and the whole
@deepseek-ai scope stays private.

The workspace constraint that required every package to be private now applies
to non-members only, and asserts the publishable trio on each release member.

packages/util/atomic-write/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-atomic-write",
   "description": "Zero-dependency atomic file replacement: exclusive-create random-suffix temp + rename carrying the caller-stated permissions (writeFileAtomic)",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/util/atomic-write"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/util/brand/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-brand",
   "description": "Type-only Branded<B> nominal-typing primitive for the DeepSeek Harness",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/util/brand"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/util/environment/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-environment",
   "description": "Immutable DeepSeek Harness launch environment that records which layer supplied each value",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/util/environment"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/util/native-command/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-native-command",
   "description": "Zero-dependency no-shell execFile runner for host-native OS integrations: utf8 stdio capture, abort propagation, Windows hide",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/util/native-command"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/util/paths/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-paths",
   "description": "Shared filesystem path helpers for the DeepSeek Harness",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/util/paths"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/util/retention/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-retention",
   "description": "Zero-dependency bounded-retention primitive: ItemRetainer/TextRetainer + neutral notice helpers (what did we keep, what did we omit)",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/util/retention"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/util/timeout/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-timeout",
   "description": "Zero-dependency timeout/deadline primitive: clampTimeout, deadline, timeoutOf, TimeoutReason (timing + classification only, no termination)",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/util/timeout"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",