feat(packages): sync package.json exports, add-only

[flipvh]

Why

packageJsonSync could not carry exports, so a subpath added upstream (e.g. a new ./config entry on a workspace package) never reached forks, and imports from synced code broke until someone added it by hand.

Revives the old unshipped feat/exports branch (ec62629, 2026-07-08) on top of current main, with guards it was missing.

What

• exports is a valid packageJsonSync key (type + zod schema)
• Add-only, like scripts: the fork gains subpaths upstream adds, keeps the ones it defines itself, and a subpath it has repointed stays repointed
• Only merges when both sides are subpath maps ({ ".": …, "./config": … }). A string or a conditions object can't take extra subpaths, and condition order is significant, so those are left untouched. The original branch ran these through safeMergeRecord, which would have spread a string-form exports into characters and alphabetically re-sorted keys
• Fork key order is kept; new subpaths are appended with their conditions in upstream's order
• README: lists exports (and the already-supported pnpm) and states the add-only rule

Testing

• Two new cases in tests/packages.test.ts: subpath add with preserved order and repointed ., and the non-subpath-map no-op
• pnpm ts, pnpm lint, vitest run tests/packages.test.ts green locally (13 tests)

🤖 Generated with Claude Code