fix: make workspace install under npm and enforce real guardrails

Replace pnpm-only workspace: protocol with npm workspace deps, pin BitVid and
BitRoad reference commits, add Node types, and make the reference-import check
scan package graphs and source for forbidden bitvid/bitroad imports.

packages/bitvid-compat/package.json

@@ -4,12 +4,18 @@
   "type": "module",
   "main": "src/index.js",
   "types": "dist/types/src/index.d.ts",
-  "files": ["dist"],
+  "files": ["src", "dist"],
+  "exports": {
+    ".": {
+      "types": "./dist/types/src/index.d.ts",
+      "import": "./src/index.js"
+    }
+  },
   "scripts": {
     "test": "vitest run"
   },
   "dependencies": {
-    "@nostr-governance/core": "workspace:*",
-    "@nostr-governance/nostr": "workspace:*"
+    "@nostr-governance/core": "*",
+    "@nostr-governance/nostr": "*"
   }
-}
+}