feat: integrate framework files into monorepo under packages/mosaic/framework/

Moves all Mosaic framework runtime files from the separate bootstrap repo
into the monorepo as canonical source. The @mosaic/mosaic npm package now
ships the complete framework — bin scripts, runtime configs, tools, and
templates — enabling standalone installation via npm install.

Structure:
  packages/mosaic/framework/
  ├── bin/          28 CLI scripts (mosaic, mosaic-doctor, mosaic-sync-skills, etc.)
  ├── runtime/      Runtime adapters (claude, codex, opencode, pi, mcp)
  ├── tools/        Shell tooling (git, prdy, orchestrator, quality, etc.)
  ├── templates/    Agent and repo templates
  ├── defaults/     Default identity files (AGENTS.md, STANDARDS.md, SOUL.md, etc.)
  ├── install.sh    Legacy bash installer
  └── remote-install.sh  One-liner remote installer

Key files with Pi support and recent fixes:
- bin/mosaic: launch_pi() with skills-local loop
- bin/mosaic-doctor: --fix auto-wiring for all 4 harnesses
- bin/mosaic-sync-skills: Pi as 4th link target, symlink-aware find
- bin/mosaic-link-runtime-assets: Pi settings.json patching
- bin/mosaic-migrate-local-skills: Pi skill roots, symlink find
- runtime/pi/RUNTIME.md + mosaic-extension.ts

Package ships 251 framework files in the npm tarball (278KB compressed).

packages/mosaic/framework/templates/agent/fragments/campsite-rule.md

@@ -0,0 +1,21 @@
+## Campsite Rule (MANDATORY)
+
+If you modify a line containing a policy violation, you MUST either:
+
+1. **Fix the violation properly** in the same change, OR
+2. **Flag it as a deferred item** with documented rationale
+
+**"It was already there" is NEVER an acceptable justification** for perpetuating a violation in code you touched. Touching it makes it yours.
+
+Examples of violations you must fix when you touch the line:
+
+- `as unknown as Type` double assertions — use type guards instead
+- `any` types — narrow to `unknown` with validation or define a proper interface
+- Missing error handling — add it if you're modifying the surrounding code
+- Suppressed linting rules (`// eslint-disable`) — fix the underlying issue
+
+If the proper fix is too large for the current scope, you MUST:
+
+- Create a TODO comment with issue reference: `// TODO(#123): Replace double assertion with type guard`
+- Document the deferral in your PR/commit description
+- Never silently carry the violation forward

packages/mosaic/framework/templates/agent/fragments/code-review.md

@@ -0,0 +1,15 @@
+## Code Review
+
+If you modify source code, independent code review is REQUIRED before completion.
+Run independent reviews:
+
+```bash
+# Code quality review (Codex)
+~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted
+
+# Security review (Codex)
+~/.config/mosaic/tools/codex/codex-security-review.sh --uncommitted
+```
+
+**Fallback:** If Codex is unavailable, use Claude's built-in review skills.
+See `~/.config/mosaic/guides/CODE-REVIEW.md` for the full review checklist.

packages/mosaic/framework/templates/agent/fragments/commit-format.md

@@ -0,0 +1,11 @@
+## Commits
+
+```
+<type>(#issue): Brief description
+
+Detailed explanation if needed.
+
+Fixes #123
+```
+
+Types: `feat`, `fix`, `docs`, `test`, `refactor`, `chore`

packages/mosaic/framework/templates/agent/fragments/conditional-loading.md

@@ -0,0 +1,17 @@
+## Conditional Documentation Loading
+
+**Load `~/.config/mosaic/guides/E2E-DELIVERY.md` first, then load the relevant guide before starting work:**
+
+| Task Type                                | Guide                                       |
+| ---------------------------------------- | ------------------------------------------- |
+| End-to-end implementation and validation | `~/.config/mosaic/guides/E2E-DELIVERY.md`   |
+| Bootstrapping a new project              | `~/.config/mosaic/guides/BOOTSTRAP.md`      |
+| Orchestrating autonomous tasks           | `~/.config/mosaic/guides/ORCHESTRATOR.md`   |
+| Frontend development                     | `~/.config/mosaic/guides/FRONTEND.md`       |
+| Backend/API development                  | `~/.config/mosaic/guides/BACKEND.md`        |
+| TypeScript strict typing                 | `~/.config/mosaic/guides/TYPESCRIPT.md`     |
+| Code review                              | `~/.config/mosaic/guides/CODE-REVIEW.md`    |
+| Authentication/Authorization             | `~/.config/mosaic/guides/AUTHENTICATION.md` |
+| Infrastructure/DevOps                    | `~/.config/mosaic/guides/INFRASTRUCTURE.md` |
+| QA/Testing                               | `~/.config/mosaic/guides/QA-TESTING.md`     |
+| Secrets management (Vault)               | `~/.config/mosaic/guides/VAULT-SECRETS.md`  |

packages/mosaic/framework/templates/agent/fragments/multi-agent.md

@@ -0,0 +1,7 @@
+## Multi-Agent Coordination
+
+When multiple agents work on this project:
+
+1. `git pull --rebase` before editing
+2. `git pull --rebase` before pushing
+3. If conflicts, **alert the user** — don't auto-resolve data conflicts

packages/mosaic/framework/templates/agent/fragments/secrets.md

@@ -0,0 +1,10 @@
+## Secrets Management
+
+**NEVER hardcode secrets.** Use `.env` files (gitignored) or a secrets manager.
+
+```bash
+# .env.example is committed (with placeholders)
+# .env is NOT committed (contains real values)
+```
+
+Ensure `.gitignore` includes `.env*` (except `.env.example`).