refactor(blast,cli,serve): Zod-Core-Out vertical slice (#109)

[stackbilt-admin]

Closes #109.

Proves the Zod-Core-Out pattern end-to-end on @stackbilt/blast: one Zod schema is the source of truth; the CLI and the new charter_blast MCP tool are thin adapters over the same pure analyze() core.

What ships

@stackbilt/blast

• Adds zod@^3.24.1 as a runtime dep. README's "zero runtime dependencies" claim updated — Zod is now the authoritative contract at the package boundary.
• New exports: BlastInputSchema, BlastOutputSchema, BlastInput, BlastOutput, DEFAULT_MAX_DEPTH, analyze().
• analyze(input: BlastInput): BlastOutput composes buildGraph + blastRadius and is what both adapters call.
• topHotFiles now uses a deterministic secondary sort (filename ascending) so tied importers counts no longer depend on filesystem scan order.
• All existing exports (buildGraph, blastRadius, topHotFiles, interfaces) preserved — fully additive per the OSS update policy.

CLI (packages/cli/src/commands/blast.ts)

• argv → build input object → BlastInputSchema.parse → analyze() → human formatter. Zod owns the --depth positive-integer rule; the manual Number.isFinite check is gone.
• detectTsconfigAliases is now exported so serve.ts reuses it.

MCP (packages/cli/src/commands/serve.ts)

• New charter_blast tool. Handler parses raw JSON-RPC args through BlastInputSchema (defaults applied there), auto-detects tsconfig aliases at scan root if the caller didn't supply them, calls analyze, returns structured JSON.
• Advertised inputSchema is a simple ZodRawShape — the SDK's ZodRawShapeCompat overload trips TS2589 on anything containing .default() chains. Defaults are documented inline in .describe() strings and applied at parse time. Authoritative schema is BlastInputSchema; the advertised shape is a documentation surface.

Decisions locked per review on #109

See the comment thread — abbreviated:

1. Zod → JSON-schema path: SDK-internal conversion. Pass the raw shape directly. No new library.
2. maxDepth SoT: single DEFAULT_MAX_DEPTH constant referenced by both the schema's .default() and blastRadius's in-function fallback. The public blastRadius behavior is unchanged — the review's concern about silent drift is addressed by the shared constant rather than by removing the in-function default (which would have broken existing programmatic consumers).
3. Snapshot AC → structural assertions: no byte-identical snapshots. Tests use BlastOutputSchema.parse(result) and targeted field checks; hotFiles determinism is enforced at the source, not in tests.
4. Schema location: @stackbilt/blast. Zod becomes a runtime dep; the "zero deps" purity was aesthetic, and colocating schemas in blast is the only arrangement that preserves the "one schema, many adapters" promise for programmatic consumers.

Known follow-ups (out of scope for this PR)

• Remove as Function casts on all three registerTool call sites once the SDK ships typings that don't hit TS2589. Reviewer's nitpick; the new registration uses the same cast as the existing two rather than introducing a mismatched style.
• Expand the pattern to validate, drift, classify, surface — one vertical slice per follow-up PR.

Acceptance criteria

• @stackbilt/blast exports Zod schemas; existing BlastRadiusResult / BlastOptions interfaces still importable.
• charter blast <path> JSON output carries the same fields as before (keys in the same order).
• charter serve registers charter_blast; tools/list surfaces the JSON schema with required: ["seeds"] and per-field descriptions.
• Unit tests cover schema validation + analyze via synthetic fixtures (no child-process tests).
• No removal or rename of existing public API.
• BlastInputSchema.parse({seeds:['x']}) yields maxDepth === DEFAULT_MAX_DEPTH (3).
• BlastOutputSchema.parse(analyze(...)) succeeds on a representative fixture.
• Tied hotFiles ordering is deterministic (filename ascending).
• packages/blast/package.json lists zod as a dependency, not devDependency.

Test plan

• pnpm build clean
• pnpm exec vitest run packages/blast — 27/27 pass (includes 11 new tests for schema + analyze)
• Full suite: 406/407 pass. The one failure (precommit-hook.test.ts > auto-tidies bloated CLAUDE.md) is a pre-existing WSL timing flake — passes in isolation (35s), times out under parallel IO contention. Not caused by this change.
• MCP end-to-end probe: tools/list returns charter_blast with correct JSON schema; tools/call with {"seeds":["src/b.ts"]} returns structurally-identical output to charter blast src/b.ts --format json against the same fixture.