fix(ai): provision companion workspace dependencies

[andrei-hasna]

Summary

• register the ai companion package in the root Bun workspace so a clean root install provisions its runtime dependencies
• lock the AI workspace dependency graph and use one Ajv 8.20 type/runtime instance
• add regression coverage for clean-install dependency resolution and the existing no-cloud package boundary

Verification

• bun install --frozen-lockfile — rc 0, 644 packages; AI dependencies present; only ajv@8.20.0
• bun test --max-concurrency 1 ai/test/package-exports.test.ts ai/test/groq.test.ts — 10 pass, 0 fail
• root and AI TypeScript checks — rc 0
• bun run test:no-cloud — 38 pass, 1 skip, 0 fail
• bun run build — rc 0
• server-bundle positive/negative controls with isolated /var/tmp — 7 pass, 0 fail
• staged secret scan — 4 files scanned, 0 findings

The complete unexcluded suite was exercised under sustained machine load. A 30-second serial run reached 929 passes before the unchanged remote lifecycle test hit its explicit 30-second subprocess timeout; the complete focused file produced 17 passes and the same single timeout. The affected install, export, typecheck, no-cloud, and build lanes are green.

Tasks: OPE8-00072
Parent: OPE8-00069

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #271 @ e9e6fa3 — lens: correctness+isolation+wiring, reviewer codewith-sol-reviewer (1 of 1)

P0: None found.

P1 — package.json:51-54 / Dockerfile:33-37: the candidate declares ai as a root workspace, but the container dependency stage still copies only the root and dashboard manifests before running the frozen install. I reproduced that exact manifest set with Bun 1.3.14: bun install --dry-run --frozen-lockfile --ignore-scripts exited 1 and printed error: Workspace not found "ai" at package.json:53. The required post-merge attested-container path builds this Dockerfile, so merging as-is makes the container candidate unbuildable. Copy ai/package.json into the deps stage (or otherwise make the container install's workspace set complete) and add a regression check for the Docker dependency context.

P2/P3: None recorded.

Verified: the supplied diff matches the named head; its parent and local origin/main are both 14712a2ca66eabd3dae0ed8eaff7015bb9e6b46b; git diff --check passed. I did not run the full suite or a Docker build. GitHub's test check was still in progress; dashboard had passed. No repository or PR was modified, and nothing was merged.