feat(tooling): pre-ship approved library traces in optional core generator templates

Each of the five optional core package generators (events, realtime, audit,
trpc, ui) now copies pre-written decision: approved trace files into
docs/library-decisions/ at scaffold time, covering every direct runtime
dependency of that core package.

This prevents a pre-commit gate failure the first time a developer runs
pnpm turbo gen core-package <name> — the generator is the policy-compliant
path, so the traces land by construction.

- Added docs/library-decisions/*.md.hbs trace files under each of the five
  core-package template directories (15 files total)
- Updated generator config to emit traces into workspace docs/library-decisions/
  via a second emitTemplateTree call per core package
- Updated all five __snapshots__/core-package/*.snapshot.json to include the
  new trace file entries
- Added verify-doc-shas.test.ts to pin SHA256 hashes of all 15 trace templates
  so snapshot and file content cannot drift independently

ADR refs: events→ADR-015, realtime→ADR-016, audit→ADR-018;
trpc and ui cite closest ADR or null where no specific ADR exists.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

turbo/generators/templates/core-package/audit/docs/library-decisions/2026-05-14-@trpc/server.md.hbs

@@ -0,0 +1,68 @@
+---
+package: "@trpc/server"
+version: "^11.0.0"
+tier: core
+decision: approved
+date: 2026-05-14
+deciders: [scaffolded]
+adr: adr-018
+filter-results:
+  license: MIT
+  types: native
+  maintenance: active
+  boundary-fit: pass
+  shadow-check: pass
+  eu-residency: n/a
+  cve-scan: clean
+  named-consumer: pass
+verification-commands:
+  - pnpm audit --audit-level=moderate
+  - npm view @trpc/server license
+accepted-cves: []
+---
+
+## Filter: license
+
+MIT — on the workspace allowlist.
+
+## Filter: types
+
+Ships first-party TypeScript types; fully type-safe by design.
+
+## Filter: maintenance
+
+Active. Maintained by the tRPC team; v11 is the current stable line.
+
+## Filter: boundary-fit
+
+Core package. `@trpc/server` is already present in `core-api` (workspace dependency). Using it in `core-audit` for the audit API router does not violate boundary rules.
+
+## Filter: shadow-check
+
+`@trpc/server` is workspace-present via `core-api`. Same major version; no shadow.
+
+## Filter: eu-residency
+
+Server-side RPC library; no vendor data transmission. n/a.
+
+## Filter: cve-scan
+
+No advisories at adoption time.
+
+## Filter: named-consumer
+
+`core-audit` exposes an audit-log tRPC router used by the `apps/web-next` API layer.
+
+## Prompt: replaces
+
+Nothing new — tRPC is already the API layer; this extends it to the audit surface.
+
+## Prompt: migration-cost-out
+
+Hard: router procedures, input schemas, and error-mapping middleware are tRPC-shaped. Removal would require replacing the audit API surface.
+
+## Prompt: alternatives-considered
+
+1. **REST endpoints** — loses end-to-end type safety already established via tRPC.
+2. **GraphQL** — much heavier; not aligned with existing workspace API shape.
+tRPC is the locked workspace API library; extending it to audit is the natural fit.

turbo/generators/templates/core-package/audit/docs/library-decisions/2026-05-14-zod.md.hbs

@@ -0,0 +1,66 @@
+---
+package: zod
+version: "^3.23.0"
+tier: core
+decision: approved
+date: 2026-05-14
+deciders: [scaffolded]
+adr: adr-018
+filter-results:
+  license: MIT
+  types: native
+  maintenance: active
+  boundary-fit: pass
+  shadow-check: pass
+  eu-residency: n/a
+  cve-scan: clean
+  named-consumer: pass
+verification-commands:
+  - pnpm audit --audit-level=moderate
+  - npm view zod license
+accepted-cves: []
+---
+
+## Filter: license
+
+MIT — on the workspace allowlist.
+
+## Filter: types
+
+Ships first-party TypeScript types in its distribution (`.d.ts` included).
+
+## Filter: maintenance
+
+Active. Regular releases by Colin McDonnell; widely adopted.
+
+## Filter: boundary-fit
+
+Core package. Zod is the workspace-canonical validation library locked in `core-shared` (ADR-018).
+
+## Filter: shadow-check
+
+Zod is already the workspace-locked validation library. No shadow.
+
+## Filter: eu-residency
+
+Pure computation; no network calls or vendor data transmission. n/a.
+
+## Filter: cve-scan
+
+No advisories at adoption time.
+
+## Filter: named-consumer
+
+`core-audit` uses zod to validate audit-log record input schemas.
+
+## Prompt: replaces
+
+Nothing — zod is the pre-existing workspace validation library.
+
+## Prompt: migration-cost-out
+
+Mechanical: swap schema definitions at call sites. No data-format lock-in.
+
+## Prompt: alternatives-considered
+
+Zod is workspace-locked (see `core-shared`). A replacement would require a workspace-wide ADR; no alternative was evaluated here.