refactor: hard-fork GSD -> MSD (Make Software Done)

Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD
across contents and paths, upstream package/repo coordinates -> @golem15/msd-core
and golem15com/msd-core. Deep links into upstream history, sibling upstream
packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is.

Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line,
package/plugin identity, regenerated lockfile, install-tree fixtures, derived
registries and benchmark baseline; migration checksum baseline re-locked
(MSD keeps its own install state, so no install had applied the old sums);
sort-order and regex-escaped expectations in tests adjusted.

tests/fixtures/representative/README.md

@@ -2,7 +2,7 @@
 
 Every fixture in this tree is **verbatim** (or, where noted, a minimal
 faithful subset) of an artifact that a real user actually produced and
-reported against a real GSD gate. None of it was written by a gate's own
+reported against a real MSD gate. None of it was written by a gate's own
 author to exercise that gate.
 
 ## Why this directory exists, and why `tests/fixtures/adversarial/` isn't enough
@@ -59,12 +59,12 @@ This is deliberately NOT node:test's `todo` option. `todo` looked like the
 right tool — a todo test executes and reports its failure without
 affecting Node's own process exit code
 (https://nodejs.org/api/test.html#test-options) — but this repo's actual
-test-runner (`gsd-test` / `gsd-test-runner` v1.6.2) has no concept of it:
+test-runner (`msd-test` / `msd-test-runner` v1.6.2) has no concept of it:
 its JSONL result parser (`internal/pipeline/parse.go`'s `parseJSONL`, in
-the separate `gsd-test-runner` repo) only recognizes `kind: "pass" | "fail"`
+the separate `msd-test-runner` repo) only recognizes `kind: "pass" | "fail"`
 and hard-errors on anything else — verified directly against that source,
 not assumed. A `{ todo: true }` test whose body throws is still counted as
-a real failure in `gsd-test`'s own verdict, which would block the push
+a real failure in `msd-test`'s own verdict, which would block the push
 gate exactly as if it weren't marked todo at all.
 
 Asserting `currentBuggyOutput` sidesteps this because the test genuinely

tests/fixtures/representative/api-coverage-detector/MANIFEST.json

@@ -21,7 +21,7 @@
     {
       "file": "non-integration-assertion.txt",
       "expectedDetected": false,
-      "note": "This line explicitly ASSERTS non-integration ('no new command/dependency') and is still read as an integration signal in the real $gsd-verify-work occurrence this was drawn from — but in isolation it already returned detected:false before #2365 (the multi-signal real occurrence needed the OTHER lines' signals to trip the gate). Included for corpus completeness."
+      "note": "This line explicitly ASSERTS non-integration ('no new command/dependency') and is still read as an integration signal in the real $msd-verify-work occurrence this was drawn from — but in isolation it already returned detected:false before #2365 (the multi-signal real occurrence needed the OTHER lines' signals to trip the gate). Included for corpus completeness."
     }
   ]
 }

tests/fixtures/representative/audit-uat/README.md

@@ -1,6 +1,6 @@
 # Audit-UAT fixtures (#2286, fixed by #2317)
 
-Verbatim reproduction files from #2286, driven through `gsd-tools
+Verbatim reproduction files from #2286, driven through `msd-tools
 audit-uat --raw` (the real CLI gate) rather than `parseUatItems` /
 `parseVerificationItems` called in isolation.