fix(cli): vendor scaffold-response types, drop file: dep on @stackbilt/contracts (#93)

@stackbilt/cli had a file:../../../contracts dep pointing to a sibling
repo that is not published to npm. Packing the tarball preserved the
file: specifier in the resulting package.json, which would cause every
downstream `npm install @stackbilt/cli` to fail with ENOENT.

Root cause: http-client.ts imported three type-only symbols (ScaffoldFileType,
GovernanceDocsType, PromptContextType) from @stackbilt/contracts/dist/scaffold-response.
The import was erased at compile time, but the declared dep was still
resolved at install time on the consumer side.

Fix: vendor the three interfaces inline at
packages/cli/src/types/scaffold-contract-types.ts and re-point the
type-only import. The contracts dep is then removed from package.json
entirely. Verified via `npm pack` tarball inspection — no more file:
specifier in the published package.json.

When @stackbilt/contracts is properly published to npm, the vendored
file can be deleted and http-client.ts re-imports from the real package.

Validation:
- pnpm run typecheck: clean
- pnpm run build: clean
- pnpm run test: 345/345 passing (no change)
- npm pack tarball: dependencies block has only workspace:^ refs (no file:)

This unblocks publishing @stackbilt/cli@0.10.0 and the full 0.10.0 release.

Co-authored-by: Kurt Overmier <kurt@stackbilt.dev>

Author: stackbilt-admin

packages/cli/package.json

@@ -43,7 +43,6 @@
     "@stackbilt/adf": "workspace:^",
     "@stackbilt/blast": "workspace:^",
     "@stackbilt/classify": "workspace:^",
-    "@stackbilt/contracts": "file:../../../contracts",
     "@stackbilt/core": "workspace:^",
     "@stackbilt/drift": "workspace:^",
     "@stackbilt/git": "workspace:^",

packages/cli/src/http-client.ts

@@ -8,7 +8,7 @@ import type {
   ScaffoldFileType,
   GovernanceDocsType,
   PromptContextType,
-} from '@stackbilt/contracts/dist/scaffold-response';
+} from './types/scaffold-contract-types';
 
 const DEFAULT_BASE_URL = process.env.STACKBILT_ENGINE_URL ?? 'https://api.stackbilt.dev/engine';
 const GATEWAY_BASE_URL = 'https://mcp.stackbilt.dev';

packages/cli/src/types/scaffold-contract-types.ts

@@ -0,0 +1,100 @@
+/**
+ * Vendored type definitions for the Stackbilt scaffold-response contract.
+ *
+ * These types are structurally copied from @stackbilt/contracts to avoid
+ * a file: workspace dependency on an unpublished sibling repo. They are
+ * type-only (erased at compile time, zero runtime cost) and are used
+ * internally by http-client.ts — they are NOT re-exported from the public
+ * CLI surface in src/index.ts.
+ *
+ * When @stackbilt/contracts is properly published to npm, this file can be
+ * deleted and http-client.ts can re-import from the real package.
+ *
+ * Upstream source (as of @stackbilt/contracts@0.1.0):
+ *   contracts/dist/scaffold-response/scaffold-response.contract.d.ts
+ *
+ * Type aliases follow the upstream naming convention with the `Type` suffix
+ * (e.g. `ScaffoldFile` → `ScaffoldFileType`), matching the re-exports in
+ * contracts/dist/scaffold-response/index.d.ts.
+ */
+
+export type FileRoleType = 'config' | 'scaffold' | 'governance' | 'test' | 'doc';
+
+export interface ScaffoldFileType {
+  path: string;
+  content: string;
+  role: FileRoleType;
+}
+
+export interface GovernanceDocsType {
+  threat_model: string;
+  adr: string;
+  test_plan: string;
+}
+
+export interface PromptContextMetaType {
+  project_type: string;
+  complexity: string;
+  confidence: string;
+  seed: number;
+}
+
+export interface PromptContextRequirementType {
+  name: string;
+  priority: string;
+  effort: string;
+  acceptance: string;
+}
+
+export interface PromptContextInterfaceType {
+  name: string;
+  layout: string;
+  components: string;
+}
+
+export interface PromptContextThreatType {
+  name: string;
+  owasp: string;
+  likelihood: string;
+  impact: string;
+  mitigation: string;
+  detection: string;
+  response_time: string;
+}
+
+export interface PromptContextRuntimeType {
+  name: string;
+  tier: string;
+  traits: string;
+}
+
+export interface PromptContextTestPlanType {
+  name: string;
+  framework: string;
+  ci_stage: string;
+  coverage: string;
+  setup: string;
+  assertion_style: string;
+}
+
+export interface PromptContextFirstTaskType {
+  name: string;
+  estimate: string;
+  complexity: string;
+  deliverable: string;
+  adr: string;
+}
+
+export interface PromptContextType {
+  intention: string;
+  pattern: string;
+  meta: PromptContextMetaType;
+  requirement: PromptContextRequirementType;
+  interface: PromptContextInterfaceType;
+  threat: PromptContextThreatType;
+  runtime: PromptContextRuntimeType;
+  test_plan: PromptContextTestPlanType;
+  first_task: PromptContextFirstTaskType;
+  governance: GovernanceDocsType;
+  files: ScaffoldFileType[];
+}