build(vendor): rescope the vendored Cordis packages into @deepseek-ai

Machine-produced by `pnpm run rescope-vendor --apply` plus the regeneration it
prints: `pnpm install` for the lockfile, `pnpm run gen-third-party-notices`,
`verify-translation-pairing --write` for the touched bilingual pairs,
`gen-doc-graphs`, and one typert snapshot whose ids embed character offsets.
`pnpm run rescope-vendor --check` verifies the result.

Renames nine vendored packages (cordis, cosmokit, schemastery and the six
@cordisjs plugins) and every reference that resolves them: manifest names and
dependency keys, module specifiers including declare-module merges, cordis.yml
plugin names, tsconfig paths, every Markdown fence, and `docs/` prose.
Directory names, upstream versions, and dependency ranges are unchanged, so
vendor/README.md still reads as an upstream snapshot; its manifest table gains
an upstream-name column so THIRD_PARTY_NOTICES keeps MIT attribution pointed
at each fork's origin.

The tutorial tier follows the rename end to end: its yaml fences named plugins
the Loader can no longer resolve, its `ts ignore-check` fences disagreed with
the compiled fences beside them, and its prose quoted both. The contracts that
told readers to keep upstream names — the root convention and the vendoring
cookbook's tree comment and manifest invariant — now say to rescope instead.

Two rules read `@deepseek-ai/` as "another workspace plugin": the client bundle
purity gate now names the vendored libraries a browser bundle inlines, and the
files where a bare `cordis` is an agent-preset id keep that product data.

packages/scaffold/helper/src/features/builtin/index.ts

@@ -101,7 +101,7 @@ config:
         id: 'default',
         label: 'Cordis HMR',
         default: true,
-        resources: [{ kind: 'npm-cordis-config-entry', id: 'hmr', package: '@cordisjs/plugin-hmr' }],
+        resources: [{ kind: 'npm-cordis-config-entry', id: 'hmr', package: '@deepseek-ai/cordis-plugin-hmr' }],
       }],
     },
     {

packages/scaffold/helper/src/features/builtin/spine.ts

@@ -26,7 +26,7 @@ class SpineOption extends FeatureOption {
 
   override contribution(_profile: ProjectProfile): ProjectContribution {
     return new ProjectContribution([
-      ...npmCordisConfigEntry(ID, { id: 'timer', name: '@cordisjs/plugin-timer' }),
+      ...npmCordisConfigEntry(ID, { id: 'timer', name: '@deepseek-ai/cordis-plugin-timer' }),
       ...npmCordisConfigEntry(ID, { id: 'llm', name: '@deepseek-ai/dsh-llm' }),
       ...npmCordisConfigEntry(ID, { id: 'session', name: '@deepseek-ai/dsh-session' }),
       ...npmCordisConfigEntry(ID, {

packages/scaffold/helper/src/invariant.ts

@@ -4,7 +4,7 @@
  */
 
 /* jscpd:ignore-start */
-import type { Context } from 'cordis'
+import type { Context } from '@deepseek-ai/cordis'
 import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
 
 const PACKAGE_NAME = '@deepseek-ai/dsh-helper'

packages/scaffold/helper/src/package-managers/link-workspace.ts

@@ -73,7 +73,7 @@ export class LinkWorkspace {
       if (packages.has(manifest.name)) throw new Error(`duplicate linked package name: ${manifest.name}`)
       packages.set(manifest.name, { directory, manifest })
     }
-    if (!packages.has('cordis') || !packages.has('@deepseek-ai/dsh-scripts')) {
+    if (!packages.has('@deepseek-ai/cordis') || !packages.has('@deepseek-ai/dsh-scripts')) {
       throw new Error(`not a DeepSeek Harness repository root: ${absolute}`)
     }
     return new LinkWorkspace(absolute, packages)

packages/scaffold/helper/src/plugins/local-plugin-blueprint.ts

@@ -83,7 +83,7 @@ export class LocalPluginBlueprint {
   documents(projectName: string, releaseVersion: string): TextProjectFile[] {
     const name = this.packageName(projectName)
     const toolName = this.name.replaceAll('-', '_')
-    const cordisSpec = resolveNpmDependency('cordis', 'devDependencies', releaseVersion).spec
+    const cordisSpec = resolveNpmDependency('@deepseek-ai/cordis', 'devDependencies', releaseVersion).spec
     const manifest = {
       name,
       version: '0.0.0',
@@ -94,10 +94,10 @@ export class LocalPluginBlueprint {
       exports: { '.': { types: './lib/index.d.ts', default: './lib/index.js' } },
       peerDependencies: {
         ...this.kind === 'tool' ? { '@deepseek-ai/dsh-tools': `^${releaseVersion}` } : {},
-        cordis: cordisSpec,
+        '@deepseek-ai/cordis': cordisSpec,
       },
       devDependencies: {
-        cordis: cordisSpec,
+        '@deepseek-ai/cordis': cordisSpec,
       },
     }
     const tsconfig = {

packages/scaffold/helper/src/project/npm-dependency-policy.ts

@@ -19,17 +19,17 @@ export interface BaselineNpmDependencies {
 }
 
 const EXTERNAL_NPM_DEPENDENCY_SPECS: Readonly<Record<string, string>> = {
-  '@cordisjs/plugin-hmr': '^1.0.15',
-  '@cordisjs/plugin-timer': '^1.1.2',
+  '@deepseek-ai/cordis-plugin-hmr': '^1.0.15',
+  '@deepseek-ai/cordis-plugin-timer': '^1.1.2',
   '@types/node': '^22.20.0',
-  cordis: '^4.0.0-rc.7',
+  '@deepseek-ai/cordis': '^4.0.0-rc.7',
   tsdown: '0.22.2',
   tsx: '^4.22.4',
   typescript: '^6.0.3',
 }
 
 const BASELINE_NPM_DEPENDENCY_NAMES: Readonly<Record<NpmDependencySection, readonly string[]>> = {
-  dependencies: ['@deepseek-ai/dsh-scripts', 'cordis'],
+  dependencies: ['@deepseek-ai/dsh-scripts', '@deepseek-ai/cordis'],
   devDependencies: ['@types/node', 'tsdown', 'tsx', 'typescript'],
 }
 

packages/scaffold/helper/src/templates/assets/local-plugin.ts.tpl

@@ -1,5 +1,5 @@
 /** Local Cordis plugin. */
-import type { Context } from 'cordis'
+import type { Context } from '@deepseek-ai/cordis'
 
 export const name = '{{pluginName}}'
 

packages/scaffold/helper/src/templates/assets/local-tool.ts.tpl

@@ -1,5 +1,5 @@
 /** Project-local model-facing tool. */
-import type { Context } from 'cordis'
+import type { Context } from '@deepseek-ai/cordis'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 
 export const name = '{{pluginName}}'