Replace pnpm-only workspace: protocol with npm workspace deps, pin BitVid and BitRoad reference commits, add Node types, and make the reference-import check scan package graphs and source for forbidden bitvid/bitroad imports.
