Reorganize packages into a modular hierarchy

Move the 18 flat packages/<name> packages into role-grouped dirs:
core/, llm/, bash/, session-persistence/, ui/, support/. Group dirs are
pure containers; each package keeps its @deepseek-ai/dsh-* name.

Collapse the per-package tsconfig paths maps (base + typecheck) into one
@deepseek-ai/dsh-* wildcard with a candidate per group, and derive the
publint list from the hierarchy. Update all depth-coupled globs/configs
(workspace, tsdown, vitest, eslint, knip, tsconfig includes/refs,
per-package tsconfigs, generators, doc-script scopes, type-equiv manifest)
and the cross-package/script relative imports in tests.

Fix doc-typecheck's workspacePaths() to parse tsconfig JSONC via the
TypeScript API instead of a regex comment-strip, which corrupted the
new wildcard `/*/` path candidates.

WIP: doc cross-links and package/RFC docs still to update.

scripts/check-workspace-constraints.ts

@@ -9,7 +9,12 @@ import { readdirSync, readFileSync } from 'node:fs'
 import { join, relative, resolve } from 'node:path'
 
 const root = resolve(import.meta.dirname, '..')
-const workspaceGlobs = ['vendor', 'packages'] as const
+// vendor/* is single-level; packages/<group>/<pkg> nests one level deeper
+// (the group dirs — core/llm/bash/… — are pure containers with no manifest).
+const workspaceGlobs = [
+  { dir: 'vendor', depth: 1 },
+  { dir: 'packages', depth: 2 },
+] as const
 const vendoredPackages = new Set([
   'cordis',
   'cosmokit',
@@ -42,15 +47,25 @@ function readJson(path: string): PackageManifest {
   return JSON.parse(readFileSync(path, 'utf8')) as PackageManifest
 }
 
+/** Repo-relative dirs holding a package.json, walked to the configured depth. */
+function packageDirs(base: string, depth: number): string[] {
+  if (depth === 1) {
+    return readdirSync(join(root, base), { withFileTypes: true })
+      .filter(entry => entry.isDirectory())
+      .map(entry => join(base, entry.name))
+  }
+  return readdirSync(join(root, base), { withFileTypes: true })
+    .filter(entry => entry.isDirectory())
+    .flatMap(group => packageDirs(join(base, group.name), depth - 1))
+}
+
 function workspaceManifests(): WorkspaceManifest[] {
   const manifests: WorkspaceManifest[] = [
     { dir: '.', manifest: readJson(join(root, 'package.json')) },
   ]
 
-  for (const workspaceDir of workspaceGlobs) {
-    for (const entry of readdirSync(join(root, workspaceDir), { withFileTypes: true })) {
-      if (!entry.isDirectory()) continue
-      const dir = join(workspaceDir, entry.name)
+  for (const { dir: base, depth } of workspaceGlobs) {
+    for (const dir of packageDirs(base, depth)) {
       manifests.push({ dir, manifest: readJson(join(root, dir, 'package.json')) })
     }
   }