packaging: group the workspace into the three prospective repos

[mfw78]

What

Move every crate, WIT package, module, fixture, script, and deploy artefact into nexum/ (L1), videre/ (L2), and shepherd/ (L3), matching the three prospective repo boundaries. One umbrella workspace root, one hoisted dependency table, and one Cargo.lock remain; intra-group relative paths are preserved byte-for-byte. Cross-group WIT edges become symlinks into the owning group, standing in for the wit-deps vendoring that lands at the carve. CI, Docker, justfile, .gitignore/.dockerignore paths updated to match.

Why

M5 needs the monorepo reorganized into the exact L1/L2/L3 groupings before the physical git-filter-repo carve, so the acyclic crate DAG and the single shared Cargo.lock can be verified in one place, right up to the cut (docs/design/videre-split-plan.md §5 Phase S2a, §6.2 D9/D10).

Part of #403 (workspace restructure - dep-sync closes it)

Testing

• nix develop -c cargo fmt --all --check
• nix develop -c cargo check --workspace --all-features

AI Assistance

Written with Claude Code assistance.

[lgahdl]

Verified this at scale — move completeness, cross-group WIT symlinks, and Cargo.toml path-dependency depth adjustments are all clean: spot-checked ~15 path deps across group boundaries and within groups, all correctly adjusted for the new nesting (or correctly left alone where both sides shifted together), root Cargo.toml's 37-entry member list is correctly bucketed, and every Rust helper that climbs CARGO_MANIFEST_DIR (builder.rs, supervisor/tests.rs, test_utils/harness.rs, videre-host/tests/*) got one more .parent() call to match the added nesting level. No file landed in the wrong group.

One real gap, found by checking the actual file content (not just the diff, since these specific lines are unchanged and don't show up as hunks):

• shepherd/docker-compose.yml:104 — ./docs/deployment/prometheus.yml:/etc/prometheus/prometheus.yml:ro was left as ./docs/... even though this file moved one level down into shepherd/, and docs/ deliberately stayed at the true repo root (confirmed: docs/deployment/prometheus.yml exists at root, shepherd/docs doesn't exist at all). This bind-mount source now resolves to a nonexistent path — Docker will auto-create an empty directory there and mount it as Prometheus's config, so Prometheus fails to start (can't parse a directory as its config file). The build.context/build.dockerfile lines just above this one in the same file were correctly adjusted (context: .., dockerfile: shepherd/Dockerfile), so this looks like a genuine oversight on this one line, not a deliberate choice.
• shepherd/docker-compose.soak.yml:69 — ./docs/operations/soak-reports:/evidence has the identical problem; this file is a 100%-similarity pure rename (zero lines adjusted), so nothing in it was touched during the move at all. The 7-day soak's evidence-writing script would silently write into a stray new shepherd/docs/operations/soak-reports/ directory instead of the real evidence path, losing the grant soak's audit trail.

Fix: both should be ../docs/... (one more ../ to reach true root from shepherd/).

Minor/cosmetic: .dockerignore keeps a leftover bare engine.toml line alongside the new shepherd/engine.toml line — harmless since nothing at repo root matches it anymore, but worth dropping for clarity.