[TheGreatAxios]

Summary

First slice of CL-4473: workflows declare tool packages as npm dependencies, and resolveWorkflowToolPackages resolves those declarations against the workflow package's laid-out node_modules/ tree, returning each tool package's name, version, directory, and interchange.tools entry. Dependency-vs-installed mismatches (missing installs, undeclared packages, renamed directories, tool-entry path escapes) surface as typed errors. Full closure materialization from the graph stays open.

Verification

• bun test src/workflows/: 63 pass, 0 fail (9 new in tool-packages.test.ts).
• bunx oxfmt --check on touched files: clean; bunx oxlint: 0 warnings, 0 errors.
• Targeted tsc on the new module: no errors.
• Full bun run check does not pass on this tree: tsc --noEmit, dead-exports, and build all fail on sibling in-flight agent-extraction state (src/agent/directors/registry.ts imports the deleted ./reviewer/package.js; dead-export reviewerPackage in agents/reviewer/), untouched by this change.

Related

Part of CL-4473

[linear-code]

CL-4473

[TheGreatAxios]

Closing and canceling CL-4473: superseded by the hub-package-registry provisioning direction (CL-10430) — npm-deps resolution is the wrong foundation now, and this branch's static-analysis check is red. Work is being tracked/absorbed by the package-registry approach.