chore(calm-suite): migrate calm-studio to npm workspaces

[gjs-opsflo]

Summary

Migrates calm-suite/calm-studio (orchestration root + 7 packages + 1 SvelteKit/Tauri app + Docusaurus docs site) from a standalone pnpm workspace into the root npm workspaces. Second half of the pnpm→npm migration tracked by #2328 — companion to PR #2407 (calm-guard).

Resolves #2328 (calm-studio portion).

Relationship to PR #2407 (calm-guard)

Independent of PR #2407. Lockfile and root package.json overlap:

• This PR adds: calm-suite/calm-studio (and globs for sub-packages/apps + docs-site)
• PR chore(calm-suite): migrate calm-guard to npm workspaces #2407 adds: calm-suite/calm-guard and calm-suite/calm-guard/docs

Whichever PR merges second will need a trivial rebase (lockfile + workspaces array merge). No logical conflicts.

Changes

Workspaces

• Root package.json workspaces array gains:
  • calm-suite/calm-studio (orchestration root, declared as calmstudio-workspace)
  • calm-suite/calm-studio/packages/* (7 packages)
  • calm-suite/calm-studio/apps/* (studio app)
  • calm-suite/calm-studio/docs-site (Docusaurus docs)

Internal dependency conversion (9 occurrences)

All workspace:* references converted to file: relative paths matching repo convention:

Source	Dependency	Target
apps/studio	@calmstudio/calm-core	file:../../packages/calm-core
apps/studio	@calmstudio/extensions	file:../../packages/extensions
packages/github-action	@calmstudio/calm-core	file:../calm-core
packages/github-action	@calmstudio/mcp	file:../mcp-server
packages/mcp-server (deps + devDeps)	@calmstudio/calm-core	file:../calm-core
packages/vscode-extension	@calmstudio/mcp	file:../mcp-server
packages/web-component	@calmstudio/calm-core	file:../calm-core
packages/web-component	@calmstudio/extensions	file:../extensions

Vitest version alignment

packages/extensions had vitest@^4.1.0 and @vitest/coverage-v8@^4.1.0; all sibling packages used ^3.x. pnpm's strict isolation hid the divergence; npm hoisting needs a single version. Aligned both to ^3.2.4.

Tauri / Vite config

• apps/studio/src-tauri/tauri.conf.json: pnpm dev/pnpm build → npm run dev/npm run build.
• apps/studio/vite.config.ts: import defineConfig from 'vitest/config' (was 'vite') so the test field typechecks. This was a latent bug.

Removed

• pnpm packageManager field from migrated package.json files.
• pnpm.overrides blocks (merged into root overrides).
• calm-suite/calm-studio/pnpm-workspace.yaml.
• calm-suite/calm-studio/pnpm-lock.yaml.

CI workflows

Three workflows rewritten:

• .github/workflows/build-calm-studio.yml: removes defaults.run.working-directory, switches to actions/setup-node with cache: npm and cache-dependency-path: package-lock.json, replaces pnpm install --frozen-lockfile with npm ci, replaces pnpm <script> with npm run <script> --if-present --workspace=@calmstudio/<pkg>. Build runs for all 8 packages; lint/typecheck/test scoped to packages with the relevant scripts.
• .github/workflows/build-calm-studio-desktop.yml: same npm setup; tauriScript becomes npm run tauri --if-present --workspace=@calmstudio/studio.
• .github/workflows/automated-release-calm-studio.yml: npm-based bootstrap before multi-semantic-release.

Lockfile

Root package-lock.json regenerated from a clean npm install. Single source of truth.

Docs sweep

Separate commit (docs(calm-suite): instruct npm usage instead of pnpm...) updates calm-studio/README.md, AGENTS.md, packages/calm-core/README.md, and the Docusaurus docs site (getting-started/quick-start.md, developer-guide/contributing.md, developer-guide/extension-packs.md, adrs/0008-docusaurus-for-documentation.md).

Validation evidence

Local validation from a clean checkout (run from repo root):

• rm -rf node_modules && CYPRESS_INSTALL_BINARY=0 npm ci — exits 0, no EUNSUPPORTEDPROTOCOL.
• Build for all 8 packages — green: calm-core, extensions, mcp, diagram, studio, github-action, vscode-extension (calmstudio), calmscript.
• Lint for calm-core, extensions, mcp, studio — green (where script exists).
• Typecheck for calm-core, extensions, mcp, github-action — green.
• Test for calm-core (4 files), extensions (3 files), mcp (7 files), studio (28 files, 419 tests) — all green.
• ! rg 'pnpm' calm-suite/calm-studio/ -g '*.md' -g '*.mdx' -g 'package.json' -g '!**/node_modules/**' — zero matches.
• ! rg 'workspace:' calm-suite/calm-studio/ -g 'package.json' -g '!**/node_modules/**' — zero matches.
• ! rg "require\.resolve\(['\"]@" calm-suite/calm-studio/ -g '!**/node_modules/**' -g '!**/dist/**' — zero matches (no webpack-static-analysis traps to fix in calm-studio source).

CI on this PR will run the rewritten Build CALM Studio workflow (build/lint/typecheck/test for the workspaces with the relevant scripts) and the desktop + release workflows (paths trigger only). All three must be green before merge.

Breaking-change notes

• pnpm is no longer the package manager for calm-studio. Contributors must run npm ci from the repo root (not pnpm install inside calm-suite/calm-studio/).
• The intermediate calm-suite/calm-studio/package.json (named calmstudio-workspace) is now an npm workspace member; npm run --workspaces --if-present from the root fans out to the calm-studio orchestration scripts.
• Renovate/Dependabot will start scanning calm-studio deps via the root package-lock.json.

Out of scope (follow-up)

• Renovate/Dependabot CVE/license-scan matrix expansion to include calm-suite — separate PR.
• Strict-typecheck cleanup for @calmstudio/diagram and @calmstudio/studio — pre-existing TS strictness errors that origin/main CI never ran. Not blocking; addressed separately if desired.