refactor(repo): centralize package subpaths

[jrusso1020]

What

Describe public package subpaths once and generate manifests and build aliases from that descriptor.

Why

Local exports, published exports, producer aliases, and CLI aliases were hand-maintained graphs that could drift.

How

Add package-subpaths.json descriptors for all public workspaces and a deterministic generator/checker consumed by build configs.

Test plan

• subpath generator tests; standalone producer/CLI builds; repository lint
• Stack-wide lint, format, build, typecheck, and relevant integration gates

[jrusso1020]

• refactor(repo): resolve changed-code audit #2174
• test(engine): isolate peer abort regression #2173
• refactor(cli): decompose render phases #2172
• refactor(cli): centralize process lifecycle #2171
• fix(cloudrun): publish adapter contract #2170
• test(repo): execute packed subpaths #2169
• refactor(repo): centralize package subpaths #2168 👈 (View in Graphite)
• refactor(core): own edit protocol contract #2167
• test(compiler): enforce preview render parity #2166
• refactor(studio): gate SDK operation families #2165
• refactor(studio): gate Acorn writer migration #2164
• refactor(producer): make capture plans immutable #2163
• refactor(producer): unify render requests #2162
• refactor(engine): type capture failures #2161
• refactor(engine): manage child process lifecycles #2160
• refactor(engine): add fingerprinted browser leases #2159
• refactor(render): centralize execution ownership #2158
• refactor(core): unify composition contract #2157
• fix(studio): enforce optimistic file concurrency #2156
• fix(studio): make sdk cutover transactional #2155
• fix(render): publish artifacts atomically #2154
• fix(render): surface structured outcomes #2153
• fix(player): own connection and media resources #2152
• fix(core): preserve runtime transport contract #2151
• fix(player): version runtime protocol #2150
• test(repo): verify packed consumers #2149
• test(repo): enforce workspace contracts #2148
• fix(core): enforce strict runtime safety #2147
• test(producer): gate source tests by execution lane #2146
• fix(core): make timing masks safe for source loaders #2145
• chore(repo): forbid tracked generated artifacts #2144
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[miguel-heygen]

Audited: package-subpaths descriptors, generated package exports/publishConfig, scripts/package-subpaths.mjs + tests, packages/cli/tsup.config.ts, and packages/producer/build.mjs; exact-head diff and surrounding package contracts were reviewed.

Verified: head 8d9d9c0 is open, mergeable, based on 11cd61d; all listed required checks are terminal green, including CLI smoke/global install, Producer tests, Windows, CodeQL, and all regression shards. Generator verification reports all 12 public workspaces in sync and its 4 contract tests pass. CLI and Producer alias maps resolve the declared local source subpaths without drift; published exports point at dist artifacts. GraphQL reviewThreads has zero unresolved non-outdated threads. CodeQL alerts #775/#777 show no active blocking state. Existing automated review coverage is noted; no additional blocker found.

— Magi

Verdict: APPROVE
Reasoning: The descriptor-driven generator and consumer aliases are consistent at the exact head, and the full required CI/CodeQL/regression surface is green with no unresolved threads.