Refactor SDK-first architecture seams (#3316)

* refactor: tighten sdk-first architecture seams

Refs #3312

* refactor: finish state document seam cleanup

Refs #3312

* test: harden minimal install cleanup assertion

* ci: support sdk-scoped package lock

* fix(3316): restore root package-lock.json and align changeset pr ref

Reverts dec57a83 ("ci: support sdk-scoped package lock") and restores
the root package-lock.json that c249d34d deleted. The deletion was the
wrong direction:

- The root package.json declares its own runtime and dev deps
  (@anthropic-ai/claude-agent-sdk, ws, c8). Without a root lockfile,
  `npm install --no-package-lock` resolves whatever satisfies semver at
  install time — CI today and CI in six months can install different
  transitive trees, defeating reproducibility.
- The lockfile has been part of every release on this repo (long
  history on main); removing it loses the npm audit / Dependabot
  target without compensating benefit.
- The CI workaround pattern (cache-dependency-path: sdk/package-lock.json
  + `npm install --no-package-lock`) papered over the symptom rather
  than fix the cause.

Also fix the changeset pr: from 3312 (issue) to 3316 (PR). CONTEXT.md
flags this exact failure mode as a recurring CodeRabbit finding.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address coderabbit review findings

* fix: close remaining coderabbit threads

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

sdk/src/query/workstream.test.ts

@@ -8,7 +8,7 @@ import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 
 import { readFile } from 'node:fs/promises';
-import { workstreamList, workstreamCreate, workstreamSet } from './workstream.js';
+import { workstreamList, workstreamCreate, workstreamSet, workstreamProgress } from './workstream.js';
 
 describe('workstreamList', () => {
   let tmpDir: string;
@@ -31,6 +31,34 @@ describe('workstreamList', () => {
   });
 });
 
+describe('workstreamProgress', () => {
+  let tmpDir: string;
+
+  beforeEach(async () => {
+    tmpDir = await mkdtemp(join(tmpdir(), 'gsd-ws-progress-'));
+    const wsDir = join(tmpDir, '.planning', 'workstreams', 'overflow');
+    await mkdir(join(wsDir, 'phases', '01-one'), { recursive: true });
+    await mkdir(join(wsDir, 'phases', '02-two'), { recursive: true });
+    await writeFile(join(wsDir, 'phases', '01-one', 'PLAN.md'), '# Plan\n');
+    await writeFile(join(wsDir, 'phases', '01-one', 'SUMMARY.md'), '# Summary\n');
+    await writeFile(join(wsDir, 'phases', '02-two', 'PLAN.md'), '# Plan\n');
+    await writeFile(join(wsDir, 'phases', '02-two', 'SUMMARY.md'), '# Summary\n');
+    await writeFile(join(wsDir, 'STATE.md'), '# State\nStatus: In progress\n');
+    await writeFile(join(wsDir, 'ROADMAP.md'), '# Roadmap\n### Phase 1: One\n');
+    await writeFile(join(tmpDir, '.planning', 'active-workstream'), 'overflow\n');
+  });
+
+  afterEach(async () => {
+    await rm(tmpDir, { recursive: true, force: true });
+  });
+
+  it('clamps progress percent when completed phase dirs exceed roadmap count', async () => {
+    const result = await workstreamProgress([], tmpDir);
+    const data = result.data as { workstreams: Array<{ progress_percent: number }> };
+    expect(data.workstreams[0].progress_percent).toBe(100);
+  });
+});
+
 describe('workstreamCreate', () => {
   let tmpDir: string;