refactor: uniform workspace scripts; remove package-identity forks in root/CI

[krisnye]

Description

Root and CI forked on package identity — the anti-pattern this PR removes:

• CI ran unit tests for a hardcoded subset of packages and merely built the
  private sample apps (a broken sample test could merge green — see ci: pin Node 24, test every package, fix data-lit-todo id-shape assumption #159), and
  applied test:node only to data-persistence.
• Root typecheck enumerated the sample packages by name.
• Root publish enumerated the six publishable packages by name — a list that
  had already drifted from the private field (it omitted data-persistence
  and data-sync, both private: false).

Every new package forced edits to these central lists, and the lists silently
diverged from reality.

Approach: uniform recursive invocation

Each package owns how it builds/tests/typechecks via standard script names.
Root and CI just call pnpm -r run <script>, which pnpm runs in dependency
(topological) order and skips packages that don't define the script. Adding
a package needs zero edits to any central list.

CI (.github/workflows/ci.yml)

Collapsed to a single job whose every step is one pnpm -r run … with no
package names: check:workspace → typecheck → lint → build → test.
Strictly more coverage than before:

• Every package is now type-checked (samples included; previously only built).
• Each package runs its complete suite — data-persistence's browser tests
  now run in CI (37 test files vs the 20 node-only ones CI ran before).

Publishing — governed only by private

pnpm -r publish publishes every private: false package and skips the rest.
Removed all publish-public scripts (6 real + 7 stale "true" no-ops on private
samples) and the hardcoded root list.

Important

data-persistence and data-sync are private: false, so under the
property-driven rule they become publishable (the old hardcoded list wrongly
excluded them). If either should stay unreleased for now, set private: true —
that one field is the single source of truth. No packages are published by this
PR; it only changes the publish script.

Convention guard + docs

• scripts/check-workspace-conventions.mjs (CI: pnpm run check:workspace)
  enforces: every package sets private explicitly (absent must never mean
  "publishable"), and no publish-public scripts exist.
• The "Workspace script conventions" section of CLAUDE.md documents the
  standard script names and the private-only publish rule.

Other

• core test now skips perf tests by default (folds the old test:ci); perf
  moved to test:perf.

Verification

Full pipeline green on Node 24 (mirrors the new CI exactly):
check:workspace ✓ · pnpm -r run typecheck ✓ (all 17 packages) · lint ✓ ·
build ✓ · test ✓ (core 245 files, data-persistence 37 incl. browser, every
sample app passing).

Related PRs

• Follows ci: pin Node 24, test every package, fix data-lit-todo id-shape assumption #159, which first widened CI test coverage; this generalizes it so the
  pipeline no longer forks on identity at all.

🤖 Generated with Claude Code