Reorganize packages into a modular hierarchy

Move the 18 flat packages/<name> packages into role-grouped dirs:
core/, llm/, bash/, session-persistence/, ui/, support/. Group dirs are
pure containers; each package keeps its @deepseek-ai/dsh-* name.

Collapse the per-package tsconfig paths maps (base + typecheck) into one
@deepseek-ai/dsh-* wildcard with a candidate per group, and derive the
publint list from the hierarchy. Update all depth-coupled globs/configs
(workspace, tsdown, vitest, eslint, knip, tsconfig includes/refs,
per-package tsconfigs, generators, doc-script scopes, type-equiv manifest)
and the cross-package/script relative imports in tests.

Fix doc-typecheck's workspacePaths() to parse tsconfig JSONC via the
TypeScript API instead of a regex comment-strip, which corrupted the
new wildcard `/*/` path candidates.

WIP: doc cross-links and package/RFC docs still to update.

scripts/publint-all.ts

@@ -1,31 +1,22 @@
 import { execFileSync } from 'node:child_process'
+import { readdirSync } from 'node:fs'
 import { resolve } from 'node:path'
 
-// publint every publishable package (vendor/ is private upstream code and
-// examples/ are not packages; both are out of scope).
-// TODO(package-inventory): derive this from the deliberate package hierarchy.
-const packages = [
-  'packages/llm',
-  'packages/session',
-  'packages/session-persistence',
-  'packages/session-persistence-jsonl',
-  'packages/session-persistence-sqlite',
-  'packages/system-prompt',
-  'packages/tools',
-  'packages/agent',
-  'packages/agent-loop',
-  'packages/bash',
-  'packages/llm-deepseek',
-  'packages/llm-pi-ai',
-  'packages/bash-local',
-  'packages/tool-bash',
-  'packages/invariants',
-  'packages/acp',
-  'packages/ui-stdio',
-  'packages/llm-replay',
-]
-
+// publint every harness package. Packages live at packages/<group>/<pkg>
+// (the group dirs — core/llm/bash/… — are pure containers); vendor/ is private
+// upstream code and examples/ are not packages, both out of scope. Derived
+// from the hierarchy so a new package needs no edit here.
 const root = resolve(import.meta.dirname, '..')
+const packagesRoot = resolve(root, 'packages')
+
+const packages = readdirSync(packagesRoot, { withFileTypes: true })
+  .filter(group => group.isDirectory())
+  .flatMap(group =>
+    readdirSync(resolve(packagesRoot, group.name), { withFileTypes: true })
+      .filter(pkg => pkg.isDirectory())
+      .map(pkg => `packages/${group.name}/${pkg.name}`),
+  )
+
 for (const path of packages) {
   execFileSync('node_modules/.bin/publint', [path], { cwd: root, stdio: 'inherit' })
 }