Add public package boundary

[nahiyankhan]

Summary

Adds the public Summon package boundary on top of the clean source import:

• renames private implementation workspaces to @summon-internal/*
• adds public facade packages: @anarchitecture/summon, @anarchitecture/summon-server, @anarchitecture/summon-react
• builds public packages from internal dist output with import rewriting, without committing generated dist
• adds public package hygiene checks and tarball smoke tests
• updates docs/demo imports to dogfood public package names
• adds Changesets config and a pinned release workflow using npm provenance and SUMMON_NPM_PUBLISH_TOKEN

Validation

• pnpm install --frozen-lockfile
• pnpm typecheck
• pnpm test
• pnpm build
• pnpm check:public-packages
• pnpm pack:dry-run
• pnpm smoke:public-packages
• pnpm test:safety
• git diff --cached --check
• scans for old @summon/*, public dist @summon-internal/* leaks, stale sourceMappingURL, obvious secrets, and accidental generated files

Notes

The first publish can happen after this merges if SUMMON_NPM_PUBLISH_TOKEN is configured. The public package manifests use semver dependencies (^0.1.0) rather than workspace protocols so packed/published manifests are consumer-safe.