Rename npm workspace packages

[JSONbored]

Problem: Five workspace packages are published under the old npm scope, and at least one (the MCP package) has real external consumers.

Area: Packages

Proposal: Rename all five workspace packages to the new scope, publish under the new names, and deprecate the old npm packages with a pointer note. Continue publishing security-relevant patches to the old package names through an agreed grace period rather than abandoning them outright.

Deliverables:

• New packages published under the new scope.
• Old packages marked deprecated on npm with a clear pointer to the replacement.

Acceptance criteria:

• All internal workspace references are updated — no broken internal imports.
• Installing an old package name shows a clear deprecation notice rather than failing silently or behaving identically forever.

Test scenarios:

• A clean install from a fresh clone succeeds under the new package names.
• Installing an old package name surfaces the deprecation notice.

Resources:

• The five workspace package manifests (engine, MCP, miner, UI, miner UI).

Boundaries:

• Do not unpublish the old npm packages — deprecate only. Unpublishing breaks anyone already pinned to them.

---

Part of #4761.

[linear-code]

JSO-3441

[JSONbored]

Update: dedicated loopover npm org confirmed — target names corrected, execution deferred.

The rename target is not @jsonbored/loopover-*. A new, dedicated npm org (loopover) now exists for this rebrand, so the five packages in this issue's scope become:

• @loopover/engine
• @loopover/mcp
• @loopover/miner
• @loopover/ui
• @loopover/ui-miner (note the word order — grouped with ui/ui-kit as the ui-* family, not miner-ui)

An initial attempt (PR #5391) used the wrong scope (@jsonbored/loopover-*) before this was caught, and has been closed rather than reworked in place — this needs real planning (confirming publish access on the new org, sequencing against #5328's ui-kit/rees rename so all seven packages move together) before it's re-attempted, not a quick fix. Deliberately deprioritized for now in favor of lower-risk items elsewhere in the milestone that don't depend on new external infrastructure (an npm org) being fully set up first.

Everything else in the original proposal (internal-import rewrite, deprecate-not-unpublish the old names, dual-installable grace period) still holds — only the target scope changes.

---

Part of #4761.