feat(node): workspace-aware node.verify — task-graph lint/typecheck/test for multi-package consumers

[gingur]

Context

Consumer repos are about to become pnpm workspaces with multiple packages (per-product monorepos: docpipe with packages/audit, packages/comms, …; looksfine with several workers + an MCP server). node.verify.yml today assumes a single package at repo root: one install, one lint, one typecheck, one test run.

Ask

Give node.verify.yml first-class workspace support:

• Task-graph execution across packages for lint / typecheck / test, aligned with whatever toolchain Upgrade to TypeScript 7 #92 lands (if the vp (Vite+) binary is adopted, vite run is the natural runner — its inference-based task cache persists across CI runs on our self-hosted runners, a speedup GitHub-hosted consumers never get; if not, pnpm -r filtering is the fallback).
• Single-package repos keep working unchanged — hooks and today's site consumers must not need any caller change. Workspace detection (e.g. presence of pnpm-workspace.yaml) beats a new required input.
• Cache wiring for the self-hosted path where the chosen runner supports it (task cache dir on the Box persists between runs; document what gets cached and how to bust it).
• Keep the workflow thin-glue per repo standards — if logic grows, it lives in a composite.

Sequencing

Blocked on #92's revised plan landing (toolchain choice shapes the runner). Do not plan this until #92's plan is approved — the operator will assign when ready.

Acceptance criteria

• A workspace consumer gets per-package lint/typecheck/test with task-graph ordering; a single-package consumer's behavior and caller YAML are byte-identical to today.
• Toolchain matches Upgrade to TypeScript 7 #92's outcome (no parallel tooling).
• Self-hosted cache behavior documented in README.