refactor: hard-fork GSD -> MSD (Make Software Done)

Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD
across contents and paths, upstream package/repo coordinates -> @golem15/msd-core
and golem15com/msd-core. Deep links into upstream history, sibling upstream
packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is.

Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line,
package/plugin identity, regenerated lockfile, install-tree fixtures, derived
registries and benchmark baseline; migration checksum baseline re-locked
(MSD keeps its own install state, so no install had applied the old sums);
sort-order and regex-escaped expectations in tests adjusted.

src/install-shadow-report.cts

@@ -1,13 +1,13 @@
 /**
  * install-shadow-report.cts — Cross-Scope Shadow Report Module (#2873, epic
  * #2866 Phase 4a — governed by
- * `.gsd/phase/feat-2873-cross-scope-shadowing/40-design.md`).
+ * `.msd/phase/feat-2873-cross-scope-shadowing/40-design.md`).
  *
  * A read-only PROJECTION over `resolveInstalledSurfaces`
  * (`installed-surface-resolver.cts`, #2872 Phase 3). That module answers
  * "what is installed"; it is documented there as read-only, and rendering
  * plus sanitization are a different concern with a different consumer set
- * (installer + `/gsd-health`) — the design doc's "Rejected" #5 is why this is
+ * (installer + `/msd-health`) — the design doc's "Rejected" #5 is why this is
  * a separate leaf module rather than a second export bolted onto the
  * resolver.
  *
@@ -54,7 +54,7 @@
  * `{a, b, c}`, and `resolveTriggerSurface` then reports `commands@local`
  * candidates for b and c too — trigger names for artifacts that do not exist
  * on disk at that scope. Left unfiltered, this module would tell the user
- * `/gsd-b` and `/gsd-c` are shadowed local commands when there is no local
+ * `/msd-b` and `/msd-c` are shadowed local commands when there is no local
  * artifact for either at all — over-reporting that is not cosmetic, since
  * the whole point of this report is to make a real failure legible.
  *
@@ -78,7 +78,7 @@
  * prefix on its output — only the already-composed `trigger` string
  * (`${prefix}${stem}`) — so the stem cannot be read off it directly. Rather
  * than hand-roll a fixed-offset `trigger.slice(4)` (which would silently
- * assume every runtime's prefix is exactly `gsd-` — true today, but not a
+ * assume every runtime's prefix is exactly `msd-` — true today, but not a
  * contract this module owns), the prefix is recovered the honest way: by
  * re-resolving that scope's `ArtifactKind` layout (`resolveRuntimeArtifactLayout`
  * / `resolveRuntimeArtifactLayoutFromRegistry`, the SAME layout descriptor
@@ -294,7 +294,7 @@ function isGenuinelyShadowed(
  * A `resolveInstalledSurfaces` `TypeError` (unknown runtime, or
  * `configHome.kind === 'none'`, e.g. vscode — design row #7) degrades to
  * `reason: RESOLVER_UNAVAILABLE` rather than propagating: an install-time or
- * `/gsd-health` caller must never crash because a runtime has no installable
+ * `/msd-health` caller must never crash because a runtime has no installable
  * config directory. Any other error type is rethrown — mirrors the
  * resolver's own `TypeError` narrowing (`resolveInstalledSurfaces`'s sweep
  * catch, and `buildScopeRecord`'s stem-derivation catch) so the two cannot
@@ -398,7 +398,7 @@ export function buildShadowReport(runtime: string, opts: ResolveInstalledSurface
 
 /**
  * Render a `ShadowReport` to plain lines — no ANSI, no color, no leading
- * indent. The caller (installer console output, `/gsd-health` text mode)
+ * indent. The caller (installer console output, `/msd-health` text mode)
  * owns terminal formatting; this keeps the module free of terminal concerns
  * and testable without a spawned process. Structured (`--json`) health
  * output (design row #17) consumes the typed `ShadowReport` directly and