feat(pnpm-policy): list first-party packages inline with packages

[pyramation]

Summary

Adds a packages: key to pnpm-policy.yaml so a workspace can claim first-party names directly, without a registry query (maintainers) or a version-pinned inventory package (inventory).

Why: fresh pgpm scaffolds pin @constructive-io/pnpm-policy@0.3.2, whose inventory was generated 2026-08-05. graphile-storage-registry isn't in it, so a new scaffold's pnpm install fails ERR_PNPM_NO_MATURE_MATCHING_VERSION on our own package — and stays broken until someone merges the weekly inventory PR, publishes, and bumps the pin. A list of names we own shouldn't be a versioned artifact.

scopes:
  - "@constructive-io"
packages:          # names or pnpm globs, emitted into minimumReleaseAgeExclude verbatim
  - pgpm
  - makage
  - "graphile-*"

Semantics in buildExclude:

• known = inventory.packages ∪ config.packages; names covered by a scope glob are still dropped.
• Config packages are explicit claims and are never intersected away (same rule as scopes); inventory-only names still honor intersect.
• maintainers without an inventory is now allowed when packages (or scopes) is set.

Companion: the pgpm-boilerplates templates will drop the two pinned inventory devDependencies and list names via packages: once this is published.

Link to Devin session: https://app.devin.ai/sessions/dd4055c50bcf4b1e8e604211038aaa82
Open in Devin Desktop: https://app.devin.ai/desktop/session/dd4055c50bcf4b1e8e604211038aaa82?variant=devin
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. No issues found — approved ✅.

---

The change reworks packages/pnpm-policy config handling and policy generation. It adds a first-class packages field to the config schema (types.ts) and normalizes it in config.ts via a dedup/sort helper, relaxes the guard in generate.ts so a config with both maintainers and packages: no longer requires a full inventory, and updates policy.ts to merge the explicit packages names with inventory-derived exemptions.

Files	Change
src/types.ts, src/config.ts	Add and normalize the new packages config field with sorting and dedup.
src/generate.ts, src/policy.ts	Merge explicit packages with inventory exemptions and adjust the no-inventory guard and membership comments.
src/cli.ts, README.md	Update starter templates and docs for the new packages field and no-inventory path.
__tests__/generate.test.ts, __tests__/policy.test.ts	Add coverage for merge, sort, dedup, and intersection semantics.

_{Reviewed commit: 57999b1}