Derive root verification task scope from workspace configuration

[taras]

Problem

The root deno.json and package.json scripts repeat increasingly long lists
of package directories. Adding a package requires updating several commands by
hand, and the duplicated lists can drift apart.

Desired outcome

Package membership has one source of truth. Root verification commands
automatically include new workspace packages unless a package is intentionally
excluded.

Prefer:

• workspace globs such as packages/* where they preserve the intended
  workspace;
• Deno's workspace-aware check and test behavior;
• Oxlint and Oxfmt configuration for stable inclusion and exclusion policy;
• one shared lint command rather than duplicating it between deno.json and
  package.json.

Keep specialized checks such as JSR publishability explicit where their scope
differs from general workspace membership.

Acceptance criteria

• Root task definitions no longer enumerate every package directory.
• Adding a normal package under packages/ includes it in lint, formatting,
  type checking, and tests without editing multiple root scripts.
• Existing verification coverage is preserved; any expanded or reduced scope
  is documented and intentional.
• packages/test-support, the site workspace, generated files, fixtures, and
  other exceptional paths have explicit, tested treatment.
• JSR publishability still considers only publishable packages.
• deno.json and package.json do not maintain competing package lists.
• CI and the repository's required verification commands pass.

Implementation note

Make this a focused repository-maintenance PR. Before changing the commands,
compare the files selected by the old and proposed tasks so the cleanup does
not silently alter verification coverage.