fix: make workspace install under npm and enforce real guardrails

Replace pnpm-only workspace: protocol with npm workspace deps, pin BitVid and
BitRoad reference commits, add Node types, and make the reference-import check
scan package graphs and source for forbidden bitvid/bitroad imports.

tsconfig.types.json

@@ -1,9 +1,21 @@
 {
   "extends": "./tsconfig.json",
   "compilerOptions": {
+    "noEmit": false,
     "emitDeclarationOnly": true,
     "declaration": true,
-    "outDir": "dist/types"
+    "declarationMap": true,
+    "outDir": "dist/types",
+    "rootDir": "."
   },
-  "include": ["packages/**/src/*.js"]
-}
+  "include": [
+    "packages/**/src/**/*.js"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist",
+    "coverage",
+    "**/test/**",
+    "**/*.test.js"
+  ]
+}