feat(workflows): sync pkgviz cyclic-dependency audit

[artiphishle]

Closes #258

Summary

• add a central Devtools PKGViz audit policy
• enable the audit only for managed repositories with a src/ tree
• render the blocking command into the managed .github/workflows/ci.yml
• pin the PKGViz CLI in one Devtools-owned policy location
• upload pkgviz-audit.json with if: always() so cycle evidence survives a blocking failure
• keep config-only repositories free of the audit through central applicability policy
• add policy and workflow rendering tests for inclusion, exclusion, exact pinning and artifact output

Managed command

bunx pkgviz@0.8.1 --out pkgviz-audit.json --rule cyclic-dependencies=block

The command uses no repository-local pkgviz dependency.

Applicability

The managed audit is rendered when the target repository has a src/ directory. Repositories without analyzable source omit the step through Devtools policy rather than local workflow edits.

Release blocker

Tracked in artiphishle/pkgviz#234.

The currently published npm package is still pkgviz@0.7.7, and that version does not support --rule.

This PR centralizes the target pin at pkgviz@0.8.1, matching the current rule-capable PKGViz package version in source. Do not merge/release this Devtools PR until a rule-capable PKGViz version is actually published and verified from npm. If the eventual published version differs, update only the central policy pin and its exact-pin test before merge.

Do not substitute latest, a GitHub SHA, or a sibling checkout.

Rollout after Devtools release

1. sync managed workflows into PKGViz and every other applicable managed repository
2. verify no repository-local PKGViz audit workflow/step remains
3. fix real dependency cycles in the owning repositories instead of adding suppressions

Validation

Final head e6cda6e:

• protected CI / validate — passed
• build — passed
• APM owner validation — passed
• Doctor — 0 errors / 0 warnings
• lint — passed
• format check — passed
• Knip — passed
• tests — 161 passed across 38 files
• typecheck — passed
• changeset status — passed

Required workflow tests cover:

• exact pinned blocking command
• source-repository inclusion
• config-only repository exclusion
• diagnostic artifact upload
• deterministic managed workflow rendering

Changeset

Minor changeset included because the managed CI contract gains a new centrally owned blocking audit.

Skills

• .agents/skills/ankhorage-coding-rules/SKILL.md
• .agents/skills/ankhorage-project-structure/SKILL.md
• .agents/skills/hexagonal-architecture/SKILL.md