fix: make workspace install under npm and enforce real guardrails

Replace pnpm-only workspace: protocol with npm workspace deps, pin BitVid and
BitRoad reference commits, add Node types, and make the reference-import check
scan package graphs and source for forbidden bitvid/bitroad imports.

docs/checkpoints.md

@@ -0,0 +1,28 @@
+# Checkpoints
+
+## Checkpoint 0 — Repo skeleton (current)
+
+Delivered:
+- npm workspaces monorepo
+- Node 22 + ESM
+- five empty packages under `packages/`
+- Vitest harness
+- TypeScript JSDoc typecheck
+- GitHub Actions CI
+- reference import guard
+- provenance docs
+
+Validation:
+```bash
+npm install
+npm run check:references
+npm run typecheck
+npm test
+npm run build:types
+```
+
+Gate: do not add runtime or BitVid codecs until fixture corpus exists.
+
+## Next checkpoint
+
+Checkpoint 1 — BitVid fixture and conformance corpus only.