Refactor SDK-first architecture seams (#3316)

* refactor: tighten sdk-first architecture seams

Refs #3312

* refactor: finish state document seam cleanup

Refs #3312

* test: harden minimal install cleanup assertion

* ci: support sdk-scoped package lock

* fix(3316): restore root package-lock.json and align changeset pr ref

Reverts dec57a83 ("ci: support sdk-scoped package lock") and restores
the root package-lock.json that c249d34d deleted. The deletion was the
wrong direction:

- The root package.json declares its own runtime and dev deps
  (@anthropic-ai/claude-agent-sdk, ws, c8). Without a root lockfile,
  `npm install --no-package-lock` resolves whatever satisfies semver at
  install time — CI today and CI in six months can install different
  transitive trees, defeating reproducibility.
- The lockfile has been part of every release on this repo (long
  history on main); removing it loses the npm audit / Dependabot
  target without compensating benefit.
- The CI workaround pattern (cache-dependency-path: sdk/package-lock.json
  + `npm install --no-package-lock`) papered over the symptom rather
  than fix the cause.

Also fix the changeset pr: from 3312 (issue) to 3316 (PR). CONTEXT.md
flags this exact failure mode as a recurring CodeRabbit finding.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address coderabbit review findings

* fix: close remaining coderabbit threads

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/workstream.test.cjs

@@ -666,6 +666,28 @@ describe('workstream progress', () => {
     assert.strictEqual(data.workstreams[0].progress_percent, 50);
   });
 
+  test('clamps progress percent when completed phase dirs exceed roadmap count', () => {
+    const isolatedDir = createTempProject();
+    try {
+      const wsDir = path.join(isolatedDir, '.planning', 'workstreams', 'overflow');
+      for (const phase of ['01-one', '02-two']) {
+        const phaseDir = path.join(wsDir, 'phases', phase);
+        fs.mkdirSync(phaseDir, { recursive: true });
+        fs.writeFileSync(path.join(phaseDir, 'PLAN.md'), '# Plan\n');
+        fs.writeFileSync(path.join(phaseDir, 'SUMMARY.md'), '# Summary\n');
+      }
+      fs.writeFileSync(path.join(wsDir, 'STATE.md'), '# State\n**Status:** In progress\n');
+      fs.writeFileSync(path.join(wsDir, 'ROADMAP.md'), '# Roadmap\n### Phase 1: One\n');
+
+      const result = runGsdTools(['workstream', 'progress', '--raw'], isolatedDir);
+      assert.ok(result.success, `progress failed: ${result.error}`);
+      const data = JSON.parse(result.output);
+      assert.strictEqual(data.workstreams[0].progress_percent, 100);
+    } finally {
+      cleanup(isolatedDir);
+    }
+  });
+
   test('returns flat mode when no workstreams exist', () => {
     const emptyDir = createTempProject();
     try {