Migrate src/ TypeScript workers into workers/ tree

[rohitg00]

Goal

Decompose the 54 TypeScript files in `src/` into separate `workers//` directories so the TS side mirrors the Rust narrow-worker structure already established in #34/#35/#38.

Current state

• `src/` holds 54 TS files, ~23k LOC
• 4 are duplicates of Rust workers: `agent-core`, `llm-router`, `memory`, `security` — these should consolidate to the Rust versions
• 50 are TS-only features: a2a, swarm, eval, evolve, feedback, hand-runner, browser, dashboard, etc
• All TS workers share `src/shared/{config,utils,metrics}.js` which makes per-file moves brittle

Blockers / risks

1. Shared utilities — `src/shared/*.js` is imported by every TS worker. Moving one worker requires either duplicating `shared/` per worker or a workspace package the workers depend on. Workspace package is cleanest.
2. BeeOS-active branches — BeeOS integration follow-ups and rollout lifecycle hardening #31 fix(agentos): sync BeeOS runtime worktree to latest main #32 are mid-flight in `src/` (touching llm-router.ts, memory.ts, evolve.ts, swarm.ts, workflow.ts, etc). Decomposition during their work creates merge conflicts.
3. Test layout — `src/tests/` has 70 test files (1,748 vitest tests). Each move needs co-located tests or a workspace-aware test config.

Proposed plan

Phase 1 — workspace package (one PR)

• Extract `src/shared/` into `packages/shared/` (or `workers/_shared/`) with its own `package.json` named `@agentos/shared`
• Update all 54 `src/*.ts` imports from `./shared/...` to `@agentos/shared`
• pnpm workspace makes this resolve in dev; published artifact is a private package

Phase 2 — duplicates (one PR per duplicate)

• For each of `agent-core`, `llm-router`, `memory`, `security`: decide canonical (Rust). Delete TS version + remove any cross-imports. Migrate any TS-only callers to use `iii.trigger("memory::recall", ...)` against the Rust worker.

Phase 3 — narrow worker moves (one PR per group of 5-10 workers)

• For each TS-only file: `mkdir workers//`, move `src/.ts` → `workers//main.ts`, add `iii.worker.yaml` (`language: node, deploy: image`), add `package.json` (deps `@agentos/shared` + `iii-sdk`), add `Dockerfile` (Node 22-slim image)
• Co-locate tests under `workers//tests/`
• Update `config.yaml` worker spawn list

Phase 4 — surface refactor

• `crates/cli` and `crates/tui` currently talk REST to `iii-http`. Switch to `iii.trigger` directly so they stay portable across worker arrangements.

Scope discipline

• Do NOT do all 50 in one PR. Group by domain (auth/security: vault, security-map, security-zeroize, security-headers; cost: cost-tracker, ledger; eval: eval, feedback, evolve; etc).
• Each group PR should ship green CI: `pnpm build`, `pnpm test`, `pnpm test:e2e`.

Coordination

• BeeOS team owns `src/llm-router.ts` + `src/memory.ts` + `src/evolve.ts` + `src/swarm.ts` + `src/workflow.ts` evolution. Confirm with them before Phase 2 deletes any of those.

Acceptance criteria

• `workers/` contains every iii worker (Rust + Python + Node)
• `src/` collapses to type defs / shared helpers only, or empties out completely
• Every `workers//` has a valid `iii.worker.yaml` (CI validator already enforces this)
• Tests still pass; e2e smoke + e2e full both green

Out of scope

• Rewriting any worker logic — this issue is purely structural
• Changing the iii-sdk API surface anywhere
• Touching `hands/`, `integrations/`, `agents/` (those stay as TOML/MD config)