refactor: hard-fork GSD -> MSD (Make Software Done)

Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD
across contents and paths, upstream package/repo coordinates -> @golem15/msd-core
and golem15com/msd-core. Deep links into upstream history, sibling upstream
packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is.

Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line,
package/plugin identity, regenerated lockfile, install-tree fixtures, derived
registries and benchmark baseline; migration checksum baseline re-locked
(MSD keeps its own install state, so no install had applied the old sums);
sort-order and regex-escaped expectations in tests adjusted.

src/phase-estimation.cts

@@ -6,7 +6,7 @@
  *
  * Pure functions only — no I/O, no config reads. Callers supply the budget and
  * the raw calibration document; this module decides policy over them. The CLI
- * seam (gsd-tools) owns reading `.planning/config.json` and
+ * seam (msd-tools) owns reading `.planning/config.json` and
  * `.planning/estimation-calibration.json`.
  *
  * Two properties this module exists to preserve, both from ADR-2629:
@@ -15,7 +15,7 @@
  *      actual/estimate ratio; `confidence` routes on a calibration sample
  *      count. Nothing routes on a model's self-assessment. This project
  *      measured self-rated confidence and found it weak
- *      (gsd-core/references/honest-verifier.md:25-29 — "on a true blind spot it
+ *      (msd-core/references/honest-verifier.md:25-29 — "on a true blind spot it
  *      stays confidently wrong"), which is why deriveConfidence() takes a
  *      sample count and there is no "how sure are you?" input anywhere here.
  *
@@ -25,7 +25,7 @@
  *      re-export so no consumer reaches for a second estimator.
  *
  * ADR-457 build-at-publish: source here, compiled to
- * gsd-core/bin/lib/phase-estimation.cjs (gitignored).
+ * msd-core/bin/lib/phase-estimation.cjs (gitignored).
  */
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- prompt-budget.cjs is an export= CommonJS module
@@ -310,7 +310,7 @@ export function computeCalibration(samples: unknown): CalibrationResult {
  */
 export function applyCalibration(rawTokens: RawTokens, factor: number): CalibratedTokens {
   // These two guards look dead to the type-checker and are not: this module is
-  // compiled to `.cjs` and consumed by untyped callers (gsd-tools.cjs, the test
+  // compiled to `.cjs` and consumed by untyped callers (msd-tools.cjs, the test
   // suite), which reach it with NaN, null, 0 and worse. The brands are a
   // compile-time contract for TypeScript callers; validation is what defends
   // everyone else. Do not delete either one because the parameter is now typed.