feat: add module contracts and discovery

docs/development/repository-workflow.md

@@ -18,6 +18,7 @@ pnpm install --frozen-lockfile
 pnpm format:check  # formatting without mutation
 pnpm lint          # Biome recommended rules
 pnpm boundaries    # architectural directions, UI ownership, and cycles
+pnpm modules:validate # installed module manifests, compatibility, and dependency graph
 pnpm typecheck     # strict TypeScript
 pnpm test          # Vitest
 pnpm build         # Turborepo package build graph
@@ -28,8 +29,12 @@ The lint, typecheck, and test commands run both repository-root checks and every
 package-level Turborepo task. New packages add their own `lint`, `typecheck`, and `test` scripts;
 the root verification command discovers them automatically.
 
-CI runs `pnpm ci`, which adds Compose configuration validation to `pnpm verify`. A separate CI job
-runs the live infrastructure smoke test so code-only local verification does not require Docker.
+`pnpm modules:validate` scans `modules/*` without a central registry. A missing or empty modules
+directory is valid and reports zero installed modules.
+
+CI runs `pnpm ci:verify`, which adds Compose configuration validation to `pnpm verify`. A separate
+CI job runs the live infrastructure smoke test so code-only local verification does not require
+Docker. The explicit suffix avoids pnpm's built-in `ci` install command.
 
 ## Development infrastructure