refactor: hard-fork GSD -> MSD (Make Software Done)

Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD
across contents and paths, upstream package/repo coordinates -> @golem15/msd-core
and golem15com/msd-core. Deep links into upstream history, sibling upstream
packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is.

Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line,
package/plugin identity, regenerated lockfile, install-tree fixtures, derived
registries and benchmark baseline; migration checksum baseline re-locked
(MSD keeps its own install state, so no install had applied the old sums);
sort-order and regex-escaped expectations in tests adjusted.

src/installed-surface-resolver.cts

@@ -1,7 +1,7 @@
 /**
  * installed-surface-resolver.cts — Installed Surface Resolver Module (#2872,
  * ADR-2866, Phase 3 — governed by
- * `.gsd/phase/feat-2872-manifest-scope-runtime/40-design.md`).
+ * `.msd/phase/feat-2872-manifest-scope-runtime/40-design.md`).
  *
  * `resolveInstalledSurfaces(runtime?, opts?)` answers a question no existing
  * module answers: "which surfaces actually exist on THIS machine, across
@@ -39,14 +39,14 @@
  * ── Installed-ness is manifest PRESENCE, never the new fields ───────────────
  * `installed` is `manifestVersion !== null`. A v1 manifest (no
  * `manifestVersion` key at all, `manifestVersion: 1` after normalization) is
- * a correct manifest written by an older GSD — never a broken one, never
+ * a correct manifest written by an older MSD — never a broken one, never
  * grounds for `installed: false`, a warning, or a reinstall prompt.
  *
  * ── Stems come from the manifest, not the source tree ───────────────────────
  * `resolveTriggerSurface` needs `stems`. They are derived from the
  * INSTALLED manifest's own `files` keys (see the private stem-derivation
  * helpers below), never from a roster read of the source tree — a global
- * `claude` install ships no `commands/gsd` source, so a roster read would
+ * `claude` install ships no `commands/msd` source, so a roster read would
  * return `[]` in exactly the configuration #2218 is about. The derivation
  * consumes `isNamespacedByDir` and `composeCommandFilename`
  * (`runtime-artifact-layout.cjs`, #2871 Phase 2's exported helpers) rather
@@ -84,7 +84,7 @@ const _require: NodeRequire = require;
 // the shapes here as a second, driftable copy — is the same pattern already
 // used elsewhere in this codebase (e.g. `phase.cts`, `config.cts`).
 
-/** One resolved `/gsd-<name>`-style trigger, as `resolveTriggerSurface`
+/** One resolved `/msd-<name>`-style trigger, as `resolveTriggerSurface`
  *  (`runtime-artifact-layout.cts`, #2871 Phase 2) produces it. */
 type TriggerSurface = ReturnType<typeof resolveTriggerSurface>[number];
 
@@ -152,14 +152,14 @@ export interface ResolveInstalledSurfacesOptions {
 
 /**
  * A trigger stem is a kebab-case token and nothing else. Verified against the
- * real roster: all 71 `commands/gsd/*.md` stems match this, so it has no false
+ * real roster: all 71 `commands/msd/*.md` stems match this, so it has no false
  * negatives today.
  *
  * This is a SECURITY boundary, not cosmetics. A stem is derived from a manifest
  * key — attacker-influenceable text, since a project-local
- * `gsd-file-manifest.json` lives inside a repository a user may merely have
- * cloned — and Phase 4 (#2873) renders it back to the user as `/gsd-<stem>`.
- * Without this, `skills/gsd-../../../x` yields the stem `..`, and control
+ * `msd-file-manifest.json` lives inside a repository a user may merely have
+ * cloned — and Phase 4 (#2873) renders it back to the user as `/msd-<stem>`.
+ * Without this, `skills/msd-../../../x` yields the stem `..`, and control
  * characters, newlines, ANSI escapes and RTL-override codepoints all survive
  * into that rendered trigger. The `commands` branch happened to be protected by
  * its `composeCommandFilename` round-trip; the `skills` branch had no