fix(packaging): pin coupled Kevlar packages

[thomhurst]

Summary

• exact-pin every shipped package coupled to Kevlar internals
• derive package verification from the core InternalsVisibleTo declarations
• reject every coupled mixed-version restore and document lockstep upgrades

Validation

• pwsh scripts/Verify-Packages.ps1 -PackagesPath artifacts/packages/issue-334-green -Version 0.0.0-local
• pwsh scripts/Verify-Docs.ps1
• pwsh scripts/Verify-Changelog.ps1
• npm ci (from docs/)
• npm run build (from docs/)

Closes #334

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c772f666-7a0e-42a7-9e93-fd57d6a10480

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}