Reorganize project layout: separate the statusline product from the installer tooling

[ropdias]

Motivation

The current layout mixes two concerns at the root: the statusline product
(tokenline.sh + install.sh) lives at the repo root, while the installer
tooling (TypeScript CLI) is spread across src/ (cli.ts, commands/,
core/, infra/, shared/). As the repo grows this blurs "what is the product"
vs "what is the tooling".

This is also timely because of #27: the Rust rewrite will add a third thing —
a Rust crate. We should pick a top-level layout that accommodates shell product +
TS installer + future Rust crate, so we don't reshuffle twice.

Proposal

Recommended layout (my suggestion):

statusline/            # the product, shipped verbatim (no build)
  tokenline.sh
  install.sh
src/                   # TS installer source → builds to dist/  (or rename to cli/)
  cli.ts, commands/, core/, infra/, shared/
# future (#27): a Rust crate, e.g. statusline-rs/ or crates/

Rationale for not putting the shell scripts under src/:

• src/ conventionally means "source compiled to dist/". tokenline.sh is the
  shipped artifact, copied verbatim — not compiled. Putting it under src/
  muddies that meaning.
• package.json files currently publishes only ["dist", "tokenline.sh"] and
  excludes src/. A top-level statusline/ keeps packaging simple; under
  src/ we'd have to publish a src/ subpath or add a build-copy step.
• A top-level statusline/tokenline.sh keeps the hero file discoverable and its
  raw URL short — important for the "copy one file and go" identity.

Alternative (the original proposal): src/statusline/{tokenline.sh, install.sh} + src/cli/{...}. Internally consistent if we accept that src/
means "all source, shell included". Captured here so the final call can be made on
this issue.

Ripple effects / checklist (the real work)

• src/core/paths.ts:8 — SCRIPT_SOURCE = join(__dirname, '..', 'tokenline.sh')
  must point at the new location, and still resolve in both dev and the
  published package.
• package.json files (["dist", "tokenline.sh"]) — ensure the script
  still ships where the resolver finds it (move the path, or copy it into
  dist/ at build time).
• tsup build entry if src/cli.ts moves/renames.
• README raw/curl URLs for tokenline.sh and install.sh — moving
  these breaks the documented one-liner installs. Update them and call out
  the path change in release notes.
• install.sh — its own reference to tokenline.sh (relative path) and any
  raw URL it curls.
• CI workflow paths (ShellCheck targets, build) under .github/workflows/.
• cli.ts:28 reads package.json via the dist __dirname at runtime, so
  it should be unaffected — verify after the move anyway.

Acceptance criteria

• pnpm build, pnpm typecheck, and ShellCheck all green.
• npm pack smoke test: install from the packed tarball and confirm
  npx … init still copies the script and patches settings.json correctly.
• README install paths updated.

Relates to #27 (design the layout with the future Rust crate in mind).