feat(workflows): sync PKGViz cyclic-dependency audit across repositories

[artiphishle]

Goal

Make the PKGViz cyclic-dependencies audit a Devtools-managed repository standard instead of a one-off workflow owned by PKGViz.

PKGViz currently contains its own CI-only enforcement:

bun bin/pkgviz.ts --out pkgviz-audit.json --rule cyclic-dependencies=block

and a repository-local reusable .github/workflows/pkgviz-audit.yml. This duplicates repository policy that belongs in the canonical Devtools workflow synchronization.

The local PKGViz copies are being removed from artiphishle/pkgviz#225. Devtools should become the single owner before this check is rolled out again.

Requirements

• Add PKGViz cyclic-dependency auditing to the Devtools-managed .github/workflows/ci.yml.
• Synchronize it to all applicable managed repositories, rather than adding repository-local copies.
• Run the rule in blocking mode:
  • cyclic-dependencies=block
  • violations must fail CI.
• Produce/upload the PKGViz audit artifact when useful for diagnosis.
• Pin the PKGViz tool/version through Devtools-owned workflow policy so repositories do not need a local pkgviz dependency merely to receive the standard check.
• Keep the implementation compatible with Devtools workflow rendering/synchronization and current Bun/Node policy.
• Determine applicability centrally. If a repository cannot meaningfully be analyzed by PKGViz, that decision must be expressed in Devtools policy rather than by hand-editing the generated workflow in that repository.
• Do not preserve PKGViz-specific workflow forks once the managed workflow is available.
• Add/extend Devtools workflow synchronization tests so the generated CI contains the audit exactly where applicable and remains deterministic.
• Update the managed-workflow ownership/documentation source as appropriate; do not hand-edit generated README artifacts.

Rollout

After release:

1. Sync the managed workflow into PKGViz and the other applicable Ankhorage repositories.
2. Verify that repositories no longer carry custom copies of the same PKGViz audit step/workflow.
3. Fix actual dependency cycles surfaced by the centralized check in the owning repositories rather than adding suppressions.

Acceptance criteria

• Devtools is the single source of truth for the PKGViz cyclic-dependency CI audit.
• Managed CI runs cyclic-dependencies=block in every applicable repository.
• A cycle produces a non-zero CI result.
• Audit evidence is available as a CI artifact or equivalent diagnostic output.
• The PKGViz version/tool invocation is centrally pinned/managed.
• Workflow sync tests cover inclusion/applicability and prevent repository-local drift.
• PKGViz and other managed repositories can receive the check through normal Devtools sync.

Skills to load

• .agents/skills/ankhorage-coding-rules/SKILL.md
• .agents/skills/ankhorage-project-structure/SKILL.md
• .agents/skills/hexagonal-architecture/SKILL.md

[artiphishle]

Owner implementation is ready in #259. Final protected CI is green: build, APM validation, Doctor, lint, format, Knip, 161 tests across 38 files, typecheck and changeset status all pass. The only remaining release gate is artiphishle/pkgviz#234: publish and verify a rule-capable PKGViz npm version, then confirm/update the single central pin in #259 before merge. After the Devtools release, normal workflow sync can roll the blocking audit out to applicable repositories.