refactor(#1289): T5 — migrate the final idiom-hard callers off the core spine (#1290)

The last 4 core importers, migrated off non-destructure idioms:
- gsd-tools.cjs: core.{error,ERROR_REASON,setJsonErrorMode,output} -> io.cjs;
  core.findProjectRoot -> project-root.cjs (lazy wrapper preserved); inline
  resolveWorktreeRoot require -> worktree-safety.cjs
- audit-command-router: DI default `_core ?? core` -> `_core ?? io` (seam preserved)
- intel-command-router: DI default -> `{ output: io.output, timeAgo: coreUtils.timeAgo }` (seam preserved)
- check-command-router: io destructure -> io.cjs; dynamic core['planningDir']
  -> planning-workspace, core['findPhaseInternal'] -> phase-locator (typed
  imports, dropped the Record-cast bracket hack)

Allowlist is now EMPTY — NO file imports the core spine. core.cts re-exports
are dead weight; T-final deletes core.cts + remaining shim tests + the lint.
No behaviour change.

Closes #1289

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

src/audit-command-router.cts

@@ -25,7 +25,7 @@
  */
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports
-import core = require('./core.cjs');
+import io = require('./io.cjs');
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -82,15 +82,15 @@ function routeAuditOpen({ args, cwd, raw, error, _audit, _core }: RouteAuditOpen
   void error;
   // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
   const a: AuditModule = _audit ?? require('./audit.cjs');
-  const c: CoreModule = _core ?? core;
+  const c: CoreModule = _core ?? io;
   const wantJson = args.includes('--json');
   const result = a.auditOpenArtifacts(cwd);
   if (wantJson) {
-    // core.output JSON-stringifies its first arg; pass the object directly.
+    // io.output JSON-stringifies its first arg; pass the object directly.
     c.output(result, raw);
   } else {
     // Human-readable report must bypass JSON encoding — use the rawValue
-    // form (third arg) which core.output emits verbatim.
+    // form (third arg) which io.output emits verbatim.
     c.output(null, true, a.formatAuditReport(result));
   }
 }