chore(calm-suite): A3 — promote calm-studio + calm-guard to top-level workspaces

[gjs-opsflo]

Description

A3 of the 5-PR Phase 1 sequence under Track A — #2649 (parent epic #2600). Promotes the two calm-suite/ sub-projects to top-level workspaces via git mv, then updates every path-bearing config (CI workflows, root manifests, in-app URLs, schema symlinks, etc.) to match the new layout.

A1 (#2661) and A2 (#2664) are merged. After A3 lands, A4 (identity reconcile) and A5 (tooling unify) can follow, and Phase 2 (Studio surface cleanup, gated on A1+A2+A3 per D-04) unblocks.

What this PR does

Moves (501 tracked files):

• calm-suite/calm-studio/ → calm-studio/
• calm-suite/calm-guard/ → calm-guard/
• calm-suite/DEPLOYMENT-RECONCILIATION.md → DEPLOYMENT-RECONCILIATION.md
• rmdir calm-suite/

The first commit is a pure rename (zero content changes) so git log --follow preserves the full history on every moved file.

Path-bearing config edits (26 files in commit 2):

Category	Files
CI workflows (9 replacements)	build-calm-studio.yml, build-calm-studio-desktop.yml, build-calm-guard.yml, automated-release-calm-studio.yml
Root config	package.json workspaces glob, .github/CODEOWNERS (split /calm-suite/ rule into separate /calm-guard/ + /calm-studio/ rules, same owner list), README.md projects-table links
calm-guard/	package.json repository.directory + homepage, src/app/api/github/create-pr/route.ts (3 user-facing PR-body URLs — would 404 on user PRs otherwise), next.config.ts (new outputFileTracingRoot pin — see below), self-references in AGENTS.md/README.md/docs/{README,docs/contributing,docs/getting-started}.md/docs/docusaurus.config.ts
calm-studio/	packages/calm-core/src/schemas/*.json (8 tracked symlinks retargeted from 6-ups to 5-ups), packages/calm-core/tsup.config.ts (CANONICAL_META resolve depth), apps/studio/vite.config.ts (comment reference)

Lockfile regen (commit 3): incremental method per the pre-existing arborist crash workaround; workspace entries rebased to new paths; 9 orphaned calm-suite/* entries dropped. Invariants preserved: minimatch@10.2.5 hoisted to root (so @vscode/vsce CJS require works), @docusaurus/faster@3.10.1 (from #2673), all 19 rollup platform-specific binaries.

One non-obvious change worth flagging

calm-guard/next.config.ts gains outputFileTracingRoot: path.join(__dirname, '..'). Why: the depth-shift from 2-deep (calm-suite/calm-guard/) to 1-deep (calm-guard/) breaks Next.js's auto-detection of the workspace root. Symptom: Module not found: Can't resolve '../../node_modules/next/dist/client/components/builtin/global-not-found.js' — Next computes the wrong number of ../ because it can mis-pick an unrelated lockfile up the directory tree. Pinning outputFileTracingRoot to the monorepo root makes the resolution deterministic.

What's deliberately NOT in this PR

• A4 territory: identity reconcile (in-app Report an issue link → FINOS, Guard docs deploy URL, VSCode web fallback) + DEPLOYMENT-RECONCILIATION.md deletion.
• A5 territory: root tooling unify (vitest base config, eslint flat config, husky/lint-staged/commitlint).
• Plan-silent items that are documentary only:
  • Root AGENTS.md — describes calm-suite/ as nested sub-monorepos. Prose; needs a follow-up rewrite but not blocking.
  • commitlint.config.js — calm-suite still in scope-enum; A5 already plans to swap for calm-studio + calm-guard. Current calm-suite scope on this PR is still valid.
  • cli/CHANGELOG.md — historical commit messages reference calm-suite/. Left intact for accuracy.
• A2's deferred items (Phase 10 + Phase 13) stay deferred — production code still imports them: 3 demos in calm-studio/apps/studio/static/demos/ (Toolbar.svelte imports), calm-guard/examples/ (DEMO_ARCHITECTURES imports), calm-studio/docs/{AIGF,REQ,SCHEMA,images} (calm-core/src/aigf/*.ts source comments cite).

Local verification (CI dep order)

• npm ci exits 0 ✓
• Each workspace builds clean in the order CI runs them (@finos/calm-models, @calmstudio/{calm-core, extensions, mcp, diagram, studio, github-action}, calmstudio, calmguard, calmguard-docs) ✓
• npm test exits 0 — 3859+ tests across 15 workspaces ✓
• cd calm-studio && npx multi-semantic-release --dry-run exits 0 ✓ (A1's deferred calmstudio-workspace manifest still discovers the 8 @calmstudio/* packages via the moved calm-studio/package.json)
• npm run package --workspace calm-plugins/vscode packages an 8.5 MB .vsix ✓
• Maven ./mvnw verify deferred to CI (local has Java 11; calm-hub needs 17+)

Type of Change

• 🔧 Chore (maintenance, dependencies, CI, etc.)

Affected Components

• CALM Hub UI (calm-hub-ui/) — none directly, but package-lock.json changes touch all workspaces' resolutions
• Documentation (docs/) — none in core docs, but calm-guard/docs/ self-refs updated
• Dependencies (lockfile)
• CI/CD (4 workflows)
• CALM Guard (calm-guard/) — moved + path-bearing edits
• CALM Studio (calm-studio/) — moved + symlink + tsup-depth edits

Commit Message Format ✅

Three commits, all DCO-signed (no Co-Authored-By):

• chore(calm-suite): A3 — git mv calm-suite/* to repo root
• chore(calm-suite): A3 — update path-bearing config after calm-suite/* move
• chore(deps): regenerate lockfile after A3 calm-suite/* → root move

Testing

• I have tested my changes locally (CI dep order — npm ci, all workspace builds, npm test, multi-semantic-release --dry-run, vsce package)
• All existing tests pass
• No new tests needed (no behaviour change — A3 is pure structural)

Checklist

• My commits follow the conventional commit format
• I have updated documentation if necessary (calm-guard/ self-references; root AGENTS.md prose left for a follow-up)
• My changes follow the project's coding standards

Refs #2649 (Track A), #2600 (parent epic). Unblocks A4 (#2651 territory), A5 (tooling unify), and Phase 2 (Studio surface cleanup) per D-04 sequencing.

[rocketstack-matt]

Clean structural-only A3 move — calm-suite/ fully removed; workspace globs, CODEOWNERS, CI path-filters, the 8 calm-core schema symlinks (now 5-ups), and the tsup CANONICAL_META depth are all correctly retargeted, and the dedicated Build CALM Guard + Build CALM Studio pipelines ran green on this commit (so the next.config.ts outputFileTracingRoot fix is CI-verified). One depth miss inline, plus a doc miss below.

AGENTS.md (root) wasn't updated for the move it makes. The package-guide links […](calm-suite/calm-studio/AGENTS.md) and […](calm-suite/calm-guard/AGENTS.md) (~lines 142–143) now 404, and the workspace-glob description calm-suite/calm-studio/packages/* / …/apps/* (~line 56) contradicts this PR's own package.json. The broader prose rewrite is fine to defer to the follow-up; the dead links and wrong globs are concrete and worth fixing here.

[rocketstack-matt]

fs.allow depth wasn't reduced for the move. cwd here is calm-studio/apps/studio, so the repo root is 3 levels up (../../..) — the unchanged ../../../.. now resolves to the repo root's parent (verified: path.resolve('../../../..') → the dir above the repo, ../../.. → the repo root). That widens the dev server's filesystem access beyond the repo and makes the adjacent "Allow up to the repo root" comment inaccurate — a small behaviour change in an otherwise behaviour-neutral PR.

Suggested change

	allow: [path.resolve('../../../..')],
	allow: [path.resolve('../../..')],

[gjs-opsflo]

@rocketstack-matt addressed both:

1. calm-studio/apps/studio/vite.config.ts:17 — fixed in 747c2048. path.resolve('../../../..') → path.resolve('../../..'). Confirmed path.resolve('../../..') from cwd calm-studio/apps/studio → repo root; ../../../.. resolves to the dir above. The fs.allow line wasn't in the path-token sed sweep I ran, hence the miss.

2. Root AGENTS.md — fixed in same commit. L56 workspace globs dropped the calm-suite/ prefix to match the updated package.json workspaces. L142-143 link text and href dropped the prefix so the package-guide links resolve. The section header ### \calm-suite/` — nested workspaces` and the surrounding prose remain — deferred to a follow-up per your guidance.

3. Rebased onto current origin/main (16e27f27). Picked up the Node 26 canonical bump; lockfile fully re-regenerated on Node 26 via the incremental method, no orphaned calm-suite/* entries left. Also resolved the file-location conflict from #2740 (calm-guard/vitest.setup.ts was added on main inside the old path — git auto-translated it to the new location during rebase).

Re-verified on Node 26.3.1:

• npm ci exits 0
• All 10 workspaces build clean in CI dep order
• npm test exits 0
• cd calm-studio && npx multi-semantic-release --dry-run exits 0
• npm run package --workspace calm-plugins/vscode packages 8.48 MB .vsix

CI re-running on the force-pushed branch.