docs(skills): update package verification policy

[egdev6]

Summary

• Updates agent/project skill policy to treat pnpm@10.34.1 as the exact package manager contract.
• Documents when package-facing changes require pnpm run build and pnpm run verify:package evidence.
• Aligns PR/package/release guidance with React 18 + React 19 consumer verification and declaration hygiene requirements.

Closes #255

Review scope

• Primary files/areas:
  • .atl/AGENTS.md
  • .atl/skills/npm-architect/SKILL.md
  • .atl/skills/pr-reviewer/SKILL.md
  • .atl/skills/release-changeset/SKILL.md
• Out of scope:
  • Runtime source changes
  • Package scripts, lockfile, CI workflow changes
  • Skill registry refresh, because frontmatter/trigger metadata did not change
• Review workload: small/medium; docs-only policy alignment across four files.

Type of change

• New component
• Existing component update/refactor
• Bug fix
• Accessibility
• Design tokens
• Storybook/docs
• Infrastructure/tooling
• NPM/dependencies

Workflow gates

• Linked issue is present with Closes #NNN or maintainer approved an exception.
• Linked issue has label status:approved before implementation starts.
• Work was started through the Project flow: assignee set, Project status In progress, branch/worktree recorded.
• PR title follows Conventional Commit format: <type>(<optional scope>): <description>.
• Commits follow the same commitlint-enforced format.
• Diff is focused; unrelated work is called out in Review scope.
• MCP/runtime artifacts are absent: .playwright-mcp, page-*.png, page-*.jpeg, *.md.playwright-output.

Component evidence (required for component changes)

• N/A — no component changes.
• N/A — no component spec changes.
• N/A — no component implementation files changed.
• N/A — no component prop defaults changed.
• N/A — no visual/token component changes.
• N/A — component audit not required for docs/skill-only policy update.
• N/A — visual review not required.

Accessibility evidence

N/A — no runtime, component, or accessibility behavior changed.

Validation evidence

• TypeScript: pre-commit typecheck passed.
• Unit tests: not run; docs/skill-only change.
• Build/package: not run; this PR documents when package evidence is required but does not change package output. Pre-commit prop-docs passed.
• Storybook or visual check: not run; no visual changes.
• Accessibility check: not run; no accessibility behavior changes.
• Security/dependency check: not run; no dependency or lockfile changes.
• Diff hygiene: git diff --check passed.
• Fresh review: approved after fixing stale vite.config.lib.ts guidance.
• Formatter: pnpm exec biome check --files-ignore-unknown=true ... processed no files because .atl markdown paths are ignored by Biome config.

Screenshots or recordings

N/A — no visual changes.

Notes for reviewer

The new verify:package requirement is intentionally conditional: it applies to package output, exports, generated declarations, peer compatibility, React major upgrades, or CI/package distribution policy changes. Routine component PRs should not become package architecture reviews unless they affect published package behavior.