Architecture WS3: TypeScript project references; typecheck via tsc -b #3279

Part of #3276.

Purpose

All 25 workspace packages set composite: true, but no tsconfig declares references, so pnpm typecheck re-checks every package per invocation and nothing enforces the package DAG at compile time. Add TypeScript project references and switch typecheck to tsc -b.

Blocked by: nothing. Overlap note: touches the R11 parts of scripts/layering/ — coordinate with the boundary-tool spike child of #3276 so R11 portions are only deleted once.

Required behavior

1. Declare references in each package tsconfig matching the real package DAG (derive from the workspace dependency graph, not from wishful thinking).
2. Change pnpm typecheck to drive tsc -b over the package graph plus the root tsconfig.json and examples/sdk/tsconfig.json.
3. Delete the parts of layering rule R11 (package-boundaries) that resolution/compilation now enforces natively, with planted-violation proof that tsc -b catches what the deleted R11 checks caught (e.g. an import from a package missing a reference must fail the build).
4. Keep pnpm check:quick semantics working.

Done when

• References are declared and pnpm typecheck uses tsc -b and passes.
• A planted illegal package import fails tsc -b (record the exact error) and the deleted R11 portion no longer exists.
• Typecheck wall time recorded before and after in the PR body (cold and warm).
• Incremental behavior proven: touch one file, show tsc -b rebuilds only its cone.

Constraints

• If tsc -b cannot express something R11 enforces (e.g. dev-only cycles or type-only exceptions), say so in the PR and keep that check — do not silently drop a guard.
• Follow docs/agents/pull-requests.md (size budget, commit shape, validation).