ci: import-boundary law + CI workflow (P0 complete)

Boundary script enforces contracts<testkit<service (catches from/side-effect/
dynamic/require imports); wired into pnpm test + CI. CI: install --frozen-lockfile
-> boundary -> typecheck -> build -> test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

vitest.config.ts

@@ -13,6 +13,6 @@ export default defineConfig({
     },
   },
   test: {
-    include: ['packages/**/src/**/*.{test,spec}.ts'],
+    include: ['packages/**/src/**/*.{test,spec}.ts', 'test/**/*.{test,spec}.ts'],
   },
 });