Pin @comapeo/core types to the backend version and verify the type surface

[gmaclennan]

Closes the gap where the published types resolved against a floating
@comapeo/core (via npm's auto-installed peer of @comapeo/ipc) while the
backend bundle embedded a different version — the root lockfile had core
7.2.0 against the backend's 7.3.0.

• Declare @comapeo/core as an exact-pinned, types-only dependency so the
  published d.ts always resolves, and against the exact core the backend
  runs. scripts/check-core-types-pin.mjs (in prepare) fails install/CI
  if the root and backend pins ever diverge.
• Add src/rpc-boundary.types.ts: an OverIpc transform re-typing resolved
  RPC values as what actually survives the JSON round-trip over the
  message port (type-fest Jsonify), preserving structure, parameters,
  emitter methods, and generic Exact<> signatures. This is the single
  divergence point for Convert date timestamps to Date objects over RPC #1 (Date revival). comapeo and
  comapeoServicesClient now export the boundary-corrected types.
• Add compile-only type-surface tests (test-d/, npm run test:types)
  pinning key API shapes against the pinned core, so a core bump that
  changes the published surface fails CI for review instead of shipping
  silently.
• Add npm run check:package: publint + attw against a packed tarball
  (types-relevant staging), gating exports/types resolution for the
  typed entrypoints under bundler and node16-ESM resolution.
• Wire both checks into lint.yml; document the layers and the core bump
  procedure in CONTRIBUTING.md and docs/TESTING.md.

Fixes #99

Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01NVFsPZBJJHnSg3DajK3ydQ

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	publint@​0.3.14
	@​arethetypeswrong/​cli@​0.18.5

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm commander is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@arethetypeswrong/cli@0.18.5 → npm/commander@10.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/commander@10.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm highlight.js is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@arethetypeswrong/cli@0.18.5 → npm/highlight.js@10.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/highlight.js@10.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report