chore(cli): scaffold pnpm workspace with six packages

[jundymek]

Summary

Creates the pnpm workspace every later story builds on: six @gitnebula/* packages (contract, scanner, deps, githist, viz, cli) with the AD-2 dependency edges physically declared in each package.json, narrow exports maps (deep imports do not resolve), a shared strict NodeNext tsconfig layout (AD-11: viz is DOM-only, contract is environment-neutral, the rest are Node-side), ESLint 9 flat config + Prettier with the AD-4 determinism ban, vitest wiring (one trivial suite per package), the two build edges (tsup for cli, vite for viz — placeholder outputs), a CI workflow definition, MIT LICENSE and CONTRIBUTING.md.

Notable decisions (details in the story's Dev Agent Record):

• AD-4 ban implemented with no-restricted-properties on exactly Date.now/Math.random (not no-restricted-globals, which would also outlaw deterministic new Date(isoFromGit) parsing that AD-13 expects). AC-3's observable behaviour is matched exactly.
• CI is trigger-disabled by maintainer decision (2026-08-11): all verification runs locally during implementation. ci.yml still defines the install + lint + typecheck + test job, but its only trigger is workflow_dispatch; restoring the push/pull_request triggers re-enables it (story 4.2 revisits the CI recipe). This is a deliberate AC-5 deviation, recorded in the spec's Dev Agent Record.
• Shared dev-dep versions pinned once via the pnpm catalog; onlyBuiltDependencies: [esbuild] committed so pnpm 10's install-script blocking is reproducible.
• cli's tsup config inlines all workspace packages (noExternal), proving the AD-11 bundle property from day one.
• Story docs at docs/dev/epic-1/1.1-workspace-scaffold/README.md (spec path — the harness checklist's docs/features/epic-1-omdb-data-layer/ epic map belongs to a different project; spec wins, divergence flagged here).

Manual verification

• pnpm install && pnpm lint && pnpm typecheck && pnpm test && pnpm build all exit 0 (Node 22, pnpm 10.34.5 via corepack).
• pnpm -r test: 6 test files passed, 11 tests passed (contract 1, the other five 2 each), 0 failed.
• AD-4 demonstrated red and green: a temp file calling Date.now()/Math.random() in packages/scanner fails eslint with two no-restricted-properties errors; the identical file in packages/cli passes (exempt).
• Deep import negative check: import('@gitnebula/contract/src/index.ts') fails with ERR_PACKAGE_PATH_NOT_EXPORTED.
• Placeholder binary runs: node packages/cli/dist/gitnebula.js prints the four wired pipeline packages; packages/viz/dist/index.html is emitted by vite.

Codex review

1 finding (P1), fixed: engines.node >=20 admitted Node 20.0–20.18, which Vite 8 does not support (^20.19.0 || >=22.12.0); floor raised to >=20.19 (still the architecture's Node 20 major) and documented.

Known issues

• Shared files: only my own sprint-status.yaml row was flipped (1.1 → review); no shared counters/status lines touched.
• The two red CI runs on this branch predate the trigger change: GitHub refused to start the jobs (account billing annotation), which prompted the maintainer's decision to skip CI/CD for now.

Refs: 1.1-workspace-scaffold
Agent: alice (terminal-agents, claude-fable-5)