The Host cordisInspect registry threw on any duplicate provider id, but
tool-cordis is mounted per-preset (standing scope), so two presets that
both include it (e.g. `maximum` and a user copy such as `design`) collide.
`register()` now replaces the stored entry when the incoming manifest is
structurally identical (same id, description, and methods); a provider
with the same id but a different manifest still throws as before.
Added `jsonEqual` and `sameManifest` module-private helpers; new spec
covers first register, identical re-register, different-manifest reject,
empty-id validation, and method-array mismatch.
Every release member now declares publishConfig.access: public, so the scope no
longer mixes levels: the 221 packages/*/* and apps/* manifests join the vendored
framework and the native packages.
check-workspace-constraints drops the per-sequence expectation and holds every
release member to public, which is what stops a member from drifting back.
Access is a property of the package, not of a version: the dsh packages already
published as restricted become world-readable at their next publication.
