build(vendor): rescope the vendored Cordis packages into @deepseek-ai

Machine-produced by `pnpm run rescope-vendor --apply` plus the regeneration it
prints: `pnpm install` for the lockfile, `pnpm run gen-third-party-notices`,
`verify-translation-pairing --write` for the touched bilingual pairs,
`gen-doc-graphs`, and one typert snapshot whose ids embed character offsets.
`pnpm run rescope-vendor --check` verifies the result.

Renames nine vendored packages (cordis, cosmokit, schemastery and the six
@cordisjs plugins) and every reference that resolves them: manifest names and
dependency keys, module specifiers including declare-module merges, cordis.yml
plugin names, tsconfig paths, every Markdown fence, and `docs/` prose.
Directory names, upstream versions, and dependency ranges are unchanged, so
vendor/README.md still reads as an upstream snapshot; its manifest table gains
an upstream-name column so THIRD_PARTY_NOTICES keeps MIT attribution pointed
at each fork's origin.

The tutorial tier follows the rename end to end: its yaml fences named plugins
the Loader can no longer resolve, its `ts ignore-check` fences disagreed with
the compiled fences beside them, and its prose quoted both. The contracts that
told readers to keep upstream names — the root convention and the vendoring
cookbook's tree comment and manifest invariant — now say to rescope instead.

Two rules read `@deepseek-ai/` as "another workspace plugin": the client bundle
purity gate now names the vendored libraries a browser bundle inlines, and the
files where a bare `cordis` is an agent-preset id keep that product data.

packages/scaffold/helper/tests/documents.spec.ts

@@ -279,10 +279,10 @@ describe('package manager strategies', () => {
     expect(inferPackageManagerName(undefined, 'unknown/1')).toBeUndefined()
     expect(inferPackageManagerName('yarn', undefined)).toBe('yarn')
     expect(() => createPackageManager('npm', 'invalid')).toThrow('invalid package manager version')
-    expect(resolveNpmDependency('cordis', 'devDependencies', '0.0.1')).toEqual({
+    expect(resolveNpmDependency('@deepseek-ai/cordis', 'devDependencies', '0.0.1')).toEqual({
       section: 'devDependencies', spec: '^4.0.0-rc.7',
     })
-    expect(resolveNpmDependency('@cordisjs/plugin-hmr', 'dependencies', '0.0.1').spec).toBe('^1.0.15')
+    expect(resolveNpmDependency('@deepseek-ai/cordis-plugin-hmr', 'dependencies', '0.0.1').spec).toBe('^1.0.15')
     expect(resolveNpmDependency('tsdown', 'devDependencies', '0.0.1').spec).toBe('0.22.2')
     expect(resolveNpmDependency('@deepseek-ai/dsh-tools', 'dependencies', '1.2.3').spec).toBe('^1.2.3')
     expect(() => resolveNpmDependency('unknown', 'dependencies', '0.0.1')).toThrow('no generated-project')
@@ -353,23 +353,23 @@ describe('package manager strategies', () => {
     await mkdir(join(root, 'vendor', 'cordis'), { recursive: true })
     await mkdir(join(root, 'packages', 'sdk', 'scripts'), { recursive: true })
     await mkdir(join(root, 'packages', 'sdk', 'helper'), { recursive: true })
-    await writeFile(join(root, 'vendor', 'cordis', 'package.json'), JSON.stringify({ name: 'cordis' }))
+    await writeFile(join(root, 'vendor', 'cordis', 'package.json'), JSON.stringify({ name: '@deepseek-ai/cordis' }))
     await writeFile(join(root, 'packages', 'sdk', 'helper', 'package.json'), JSON.stringify({ name: '@deepseek-ai/dsh-helper' }))
     await writeFile(join(root, 'packages', 'sdk', 'scripts', 'package.json'), JSON.stringify({
-      name: '@deepseek-ai/dsh-scripts', dependencies: { '@deepseek-ai/dsh-helper': '^0.0.1' }, peerDependencies: { cordis: '^4' },
+      name: '@deepseek-ai/dsh-scripts', dependencies: { '@deepseek-ai/dsh-helper': '^0.0.1' }, peerDependencies: { '@deepseek-ai/cordis': '^4' },
     }))
     const workspace = await LinkWorkspace.open(root)
     expect(workspace.closure(['@deepseek-ai/dsh-scripts'])).toEqual([
-      '@deepseek-ai/dsh-helper', '@deepseek-ai/dsh-scripts', 'cordis',
+      '@deepseek-ai/cordis', '@deepseek-ai/dsh-helper', '@deepseek-ai/dsh-scripts',
     ])
     const manifest = PackageJsonFile.create('{"name":"consumer","description":"test"}')
     manifest.setNpmDependency('dependencies', '@deepseek-ai/dsh-scripts', '^0.0.1')
     const pnpmWorkspace = PnpmWorkspaceFile.create()
     workspace.apply(join(root, 'consumer'), manifest, new PnpmPackageManager('10.0.0'), [pnpmWorkspace])
-    expect(manifest.npmDependency('cordis')?.spec).toMatch(/^link:/)
+    expect(manifest.npmDependency('@deepseek-ai/cordis')?.spec).toMatch(/^link:/)
     expect(pnpmWorkspace.serialize()).toContain('autoInstallPeers: false')
-    expect(workspace.packageDirectory('cordis')).toBe(join(root, 'vendor', 'cordis'))
-    expect(await readFile(join(root, 'vendor', 'cordis', 'package.json'), 'utf8')).toContain('cordis')
+    expect(workspace.packageDirectory('@deepseek-ai/cordis')).toBe(join(root, 'vendor', 'cordis'))
+    expect(await readFile(join(root, 'vendor', 'cordis', 'package.json'), 'utf8')).toContain('@deepseek-ai/cordis')
     expect(workspace.packageDirectory('missing')).toBeUndefined()
     // A generated workspace member resolves its own dependencies: every local name it
     // declares relinks, while a peer keeps the range package managers require there.

packages/scaffold/helper/tests/project.spec.ts

@@ -187,12 +187,12 @@ describe('SdkProject and ProjectEditSession', () => {
     expect(project.cordis.entry('scope-invariant')?.name).toBe('@deepseek-ai/dsh-scope/invariant')
     expect(project.cordis.entry('agent-loop-invariant')?.name).toBe('@deepseek-ai/dsh-agent-loop/invariant')
     expect(project.cordis.entry('system-prompt')?.config?.persona).toContain('{{cwd}}')
-    expect(project.packageManifest().dependencies?.['@cordisjs/plugin-timer']).toBe('^1.1.2')
-    expect(project.packageManifest().dependencies?.['@cordisjs/plugin-hmr']).toBe('^1.0.15')
+    expect(project.packageManifest().dependencies?.['@deepseek-ai/cordis-plugin-timer']).toBe('^1.1.2')
+    expect(project.packageManifest().dependencies?.['@deepseek-ai/cordis-plugin-hmr']).toBe('^1.0.15')
     expect(project.packageManifest().dependencies?.['@deepseek-ai/dsh-scope']).toBe('^0.0.1')
     expect(project.packageManifest().dependencies).not.toHaveProperty('@deepseek-ai/dsh-scope/invariant')
     expect(project.packageManifest().dependencies).not.toHaveProperty('node-addon-require-builtin')
-    expect(project.cordis.entry('hmr')).toMatchObject({ name: '@cordisjs/plugin-hmr' })
+    expect(project.cordis.entry('hmr')).toMatchObject({ name: '@deepseek-ai/cordis-plugin-hmr' })
     expect(project.cordis.entry('llm-deepseek')).not.toHaveProperty('config.apiKey')
     expect(project.cordis.entry('llm-deepseek')?.config).not.toHaveProperty('baseURL')
     expect(project.cordis.entry('llm-deepseek')?.config).not.toHaveProperty('models')
@@ -502,7 +502,7 @@ describe('SdkProject and ProjectEditSession', () => {
     internals.applyResource(transient, undefined)
     internals.removeResource(transient)
     internals.replaceContribution(
-      new ProjectContribution([{ kind: 'npm-dependency', key: resourceKey('shared'), name: 'cordis', section: 'dependencies' }]),
+      new ProjectContribution([{ kind: 'npm-dependency', key: resourceKey('shared'), name: '@deepseek-ai/cordis', section: 'dependencies' }]),
       new ProjectContribution([{
         kind: 'cordis-config-entry', key: resourceKey('shared'), entry: { id: 'new', name: 'new' }, ownedConfigKeys: [],
       }]),