feat: standalone module-build readiness for the public @ekklesia packages (ADR 0053)

Makes the public module-development package set usable from a module
repository outside the monorepo. Nothing is published.

- Curated @ekklesia/module-sdk: an explicit author API, no contracts
  barrel, no identity/authorization internals, no Drizzle and no legacy
  ModuleDatabase type. defineModuleRuntime returns the SDK's own named
  interfaces so a module's emitted declarations never reach into
  @ekklesia/contracts. defineModuleSchema is gone; createModuleTable and
  defineModuleSchemaMetadata live in @ekklesia/module-database.
- Drizzle: no longer a dependency of module-sdk or contracts. Core keeps
  the legacy Drizzle schema validator (moved to core/src/modules) and
  its legacy runtime support; drizzle-orm is an optional peer only.
- React is a peer (plus devDependency) of @ekklesia/ui; the boundary
  checker allows exactly that consumer-selected peer.
- @ekklesia/typescript-config is publishable; module-ui-host is private.
  Every public package carries "ekklesia.distribution":
  "module-development" and no monorepo-root prepack.
- module-pack reads the Node.js range from the module's own engines.node
  and recognizes Ekklesia packages by name plus that marker, so
  registry-installed packages are incorporated, SDK-compatibility
  checked, and never credited as third-party.
- scripts/pack-public-packages.ts (pnpm packages:pack) rebuilds, packs
  and inspects the nine public tarballs; scripts/test-standalone-module.sh
  (pnpm test:standalone-module, new CI job) installs them into a fixture
  module outside the repository and proves it typechecks, builds,
  packages, and verifies.
- Public-package boundary tests and module-development docs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/module-ui-sdk/package.json

@@ -15,7 +15,6 @@
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
     "lint": "biome lint .",
-    "prepack": "pnpm --workspace-root exec turbo run build --filter=@ekklesia/module-ui-sdk",
     "test": "vitest run",
     "typecheck": "tsc --noEmit --project tsconfig.json && tsc --noEmit --project tsconfig.test.json"
   },
@@ -26,6 +25,7 @@
     "vitest": "4.1.10"
   },
   "ekklesia": {
-    "layer": "module-ui-sdk"
+    "layer": "module-ui-sdk",
+    "distribution": "module-development"
   }
 }

packages/module-ui-sdk/tests/browser-safety.test.ts

@@ -11,9 +11,9 @@ async function sourceFiles(): Promise<string[]> {
 }
 
 /**
- * This package is bundled into a browser. `@ekklesia/module-sdk` re-exports all of
- * `@ekklesia/contracts`, which pulls Zod, Drizzle, and semver behind one barrel export, so a single
- * value import from a backend package here would drag that whole graph into every module UI bundle
+ * This package is bundled into a browser. `@ekklesia/module-sdk` is built on `@ekklesia/contracts`,
+ * which pulls Zod and semver behind one barrel export, so a single value import from a backend
+ * package here would drag that whole graph into every module UI bundle
  * (ADR 0022). ADR 0024 removed even the former type-only contracts dependency because its type graph
  * leaked Node globals into browser programs; this package must remain completely dependency-free.
  */