chore(packages): normalize public package contracts

[ty-everett]

Advances #324 Wave 7 and the npm-artifact remainder of Wave 6.

Changes

• standardizes all 30 public packages on engines.node: ">=22", explicit public npm access, and explicit tree-shaking metadata;
• adds missing export maps for DID Client, Teranode Listener, and the three Wallet Toolbox packages;
• adds missing files allowlists for Overlay Topics, BTMS Permission Module, and the Wallet Toolbox client/mobile packages;
• ships the existing Open BSV v4 Wallet Toolbox license with its client/mobile packages;
• adds missing READMEs for the conformance runner, docs site, and Paymail examples;
• distinguishes the Node 24.11 contributor/release toolchain from the Node 22 consumer runtime and corrects stale runtime/image documentation;
• strengthens repository health so all public-package runtime/access/side-effect declarations are exact and ratchets contract findings from 241 to 148.

This deliberately does not guess the unresolved licenses, add a false Amountinator export map, add fake quality scripts, bump versions, publish packages, or change service CORS/CSP behavior. Those remain visible follow-up gates in #324.

Verification

• pnpm health:check — 20 control tests pass; 37 projects / 30 public packages / 148 ratcheted findings / 0 control errors
• pnpm build — all 36 non-root workspaces pass
• pnpm --filter docs-site validate and pnpm --filter docs-site build — 94 source routes and 99 rendered HTML files pass link validation
• pnpm check-versions — pass
• pnpm audit:security — no known vulnerabilities
• ESM/CJS self-reference checks pass for all newly exported package roots
• npm pack --dry-run --json --ignore-scripts confirms the seven changed package artifacts contain no tests/specs
• raw pnpm test reaches the pre-existing private example-paymail placeholder and fails there by design; this is still ratcheted as placeholder-quality-script and is excluded by the current CI assertion runner until it is replaced with a real deterministic test. All suites completed before that boundary passed, including 6,650 conformance vectors, SDK 5,700 tests, and VeriFast real ESM/CJS/WASM/browser consumers.

No npm package, image, or deployed workload is published or changed by this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Maintainer approval-in-substance (ty-everett): I reviewed the complete diff, the package-contract ratchet, published-file dry runs, ESM/CJS consumer checks, and the wallet-toolbox compatibility correction at 66f2fec6b. All required checks are green, Sonar reports zero new issues/hotspots, Codecov reports all modified coverable lines covered, and there are no unresolved review threads.

GitHub does not permit an author to submit a formal approving review on their own PR, so this comment records the required maintainer approval and the authorized admin merge rationale.