ci: add packaging & monorepo consistency validation (publint + attw + sherif)

[martyy-code]

Description

Add lightweight CI jobs that validate the published packaging and version consistency of the monorepo:

• publint — validates package.json / exports / files / main / types of the published lib.
• @arethetypeswrong/cli (attw) — resolves types against node16 / nodenext / bundler and surfaces real consumer-facing defects (types-only exports vanishing in CJS, missing defaults, bad module syntax).
• sherif — zero-dep check for version consistency across workspace packages (misplaced @types/*, desync between next and eslint-config-next, alphabetical dep order, etc.).

Why

• attw would have caught the existing bug at packages/type-testing/src/types/special.ts:5 (import missing .js extension) when targeting nodenext.
• These three tools cover distinct layers (packaging shape, type resolution, version drift) with negligible cost — fit easily as required checks on PRs.
• We currently rely on humans noticing these issues at review time.

Acceptance criteria

• New CI jobs (or scripts wired into turbo run lint) for publint, attw, and sherif.
• All three pass against the current repo after fixing the special.ts import issue.
• Wired as required checks on PRs to main.
• Documented in CONTRIBUTING.md under the "Code quality" section.

Notes

• tsdown can integrate publint and attw natively as lint: { publint: true, attw: true }; defer that switch to a separate issue if/when we move off tsc -b.
• sherif is preferred over syncpack while the latter's Rust rewrite is in progress.

[martyy-code]

Triage complete

• Type: Feature
• Area: ci, build
• Status: ready
• Priority: Medium
• Effort: Low

Verification: CONFIRMED — publint, @arethetypeswrong/cli, and sherif are not installed in the repo; packages/type-testing/src/types/special.ts:5 has from './equality' without the .js extension, which is exactly the kind of issue attw would surface.

Next steps: This is ready to be picked up.

See also #35 for the root cause fix (special.ts import).

Triage by @martyy-code.

[martyy-code]

Implementation started

PR opened: #46

The spec at docs/internal/plans/34/plan.md was reviewed and approved (2026-07-13). Implementation complete; all four checks green locally:

• pnpm build ✅
• pnpm typecheck ✅ (3 packages)
• pnpm test ✅ (252 tests)
• pnpm check:packaging ✅ (publint + attw + sherif)

Surface findings fixed inline (anticipated by the spec risk section):

• Second bare-relative import at src/types/property.ts:5 (same as special.ts:5) — attw surfaced this on first run.
• exports map: types condition first, nested import.types for moduleResolution: "bundler", default condition on each entrypoint — publint surfaced.
• Workspace drift: align eslint (apps/web) + typescript (apps/web, examples) ranges — sherif surfaced.

attw note: the script passes --ignore-rules no-resolution cjs-resolves-to-esm because the lib is ESM-only and these rules are intrinsic noise for ESM-only packages. Both exclusions are documented in the script invocation; the matrix table is otherwise green across node10 / node16 (CJS) / node16 (ESM) / bundler.

Post-merge step (repo-settings, not in the PR diff): flip the three new CI jobs into the branch-protection required-status-checks list. The exact gh api command is in the PR description.

Triage by @martyy-code.

[JamieMason]

preferred over syncpack while the latter's Rust rewrite is in progress.

The rust rewrite is complete BTW, since 14.0.0