feat: scope dependency hygiene by workspace

[bntvllnt]

Summary

• scope no-unused-deps to the nearest package/workspace manifest
• report per-package unused, unlisted, type-only, test-only, and runtime-from-devDependencies drift
• preserve single-package dependency hygiene behavior and add workspace fixture coverage
• update schema, docs, and roadmap with CH-P1-07

Tests

• pnpm lint
• pnpm typecheck
• pnpm build
• pnpm test (32 files, 463 tests)
• pnpm verify:cli-real (59 pass, 0 fail)
• git diff --check

Review

• /tmp/code-review-workspace-dependency-policy.json
• CLEAN verdict; low blast radius on src/rules/dead-code.ts