Refactor SDK-first architecture seams (#3316)

* refactor: tighten sdk-first architecture seams

Refs #3312

* refactor: finish state document seam cleanup

Refs #3312

* test: harden minimal install cleanup assertion

* ci: support sdk-scoped package lock

* fix(3316): restore root package-lock.json and align changeset pr ref

Reverts dec57a83 ("ci: support sdk-scoped package lock") and restores
the root package-lock.json that c249d34d deleted. The deletion was the
wrong direction:

- The root package.json declares its own runtime and dev deps
  (@anthropic-ai/claude-agent-sdk, ws, c8). Without a root lockfile,
  `npm install --no-package-lock` resolves whatever satisfies semver at
  install time — CI today and CI in six months can install different
  transitive trees, defeating reproducibility.
- The lockfile has been part of every release on this repo (long
  history on main); removing it loses the npm audit / Dependabot
  target without compensating benefit.
- The CI workaround pattern (cache-dependency-path: sdk/package-lock.json
  + `npm install --no-package-lock`) papered over the symptom rather
  than fix the cause.

Also fix the changeset pr: from 3312 (issue) to 3316 (PR). CONTEXT.md
flags this exact failure mode as a recurring CodeRabbit finding.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address coderabbit review findings

* fix: close remaining coderabbit threads

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/bug-3017-codex-hook-absolute-node.test.cjs

@@ -118,18 +118,19 @@ describe('Bug #3017: buildCodexHookBlock emits absolute node runner', () => {
       'must return null on missing runner so caller can warn-and-skip instead of writing a broken hook');
   });
 
-  test('integrates with resolveNodeRunner() in the live process — runner equals process.execPath (#3022 CR)', () => {
+  test('integrates with resolveNodeRunner() in the live process — runner equals resolved node runner (#3022 CR)', () => {
     const runner = resolveNodeRunner();
     assert.ok(runner, 'resolveNodeRunner returns a usable value in this test env');
     const block = buildCodexHookBlock('/tmp/x/.codex', { absoluteRunner: runner });
     const parsed = parseCodexHookBlock(block);
     assert.equal(parsed.ok, true);
-    // Strict canonical-runner equality: the parsed runner (after
-    // stripping toml + JSON escape layers) must be exactly process.execPath
-    // (forward-slashed, since resolveNodeRunner normalizes that way).
-    const expected = process.execPath.replace(/\\/g, '/');
+    // Strict canonical-runner equality: the parsed runner (after stripping
+    // toml + JSON escape layers) must be exactly the normalized runner that
+    // resolveNodeRunner selected. Homebrew Cellar execPath values intentionally
+    // normalize to the stable Homebrew symlink (#3181).
+    const expected = JSON.parse(runner);
     assert.equal(unescapeRunner(parsed.runner), expected,
-      `parsed runner must equal process.execPath, got: ${parsed.runner}, want: ${expected}`);
+      `parsed runner must equal resolveNodeRunner(), got: ${parsed.runner}, want: ${expected}`);
   });
 });