feat(tooling): pre-ship approved library traces in optional core generator templates

Each of the five optional core package generators (events, realtime, audit,
trpc, ui) now copies pre-written decision: approved trace files into
docs/library-decisions/ at scaffold time, covering every direct runtime
dependency of that core package.

This prevents a pre-commit gate failure the first time a developer runs
pnpm turbo gen core-package <name> — the generator is the policy-compliant
path, so the traces land by construction.

- Added docs/library-decisions/*.md.hbs trace files under each of the five
  core-package template directories (15 files total)
- Updated generator config to emit traces into workspace docs/library-decisions/
  via a second emitTemplateTree call per core package
- Updated all five __snapshots__/core-package/*.snapshot.json to include the
  new trace file entries
- Added verify-doc-shas.test.ts to pin SHA256 hashes of all 15 trace templates
  so snapshot and file content cannot drift independently

ADR refs: events→ADR-015, realtime→ADR-016, audit→ADR-018;
trpc and ui cite closest ADR or null where no specific ADR exists.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

turbo/generators/templates/core-package/ui/docs/library-decisions/2026-05-14-clsx.md.hbs

@@ -0,0 +1,68 @@
+---
+package: clsx
+version: "^2.1.1"
+tier: core
+decision: approved
+date: 2026-05-14
+deciders: [scaffolded]
+adr: null
+filter-results:
+  license: MIT
+  types: native
+  maintenance: active
+  boundary-fit: pass
+  shadow-check: pass
+  eu-residency: n/a
+  cve-scan: clean
+  named-consumer: pass
+verification-commands:
+  - pnpm audit --audit-level=moderate
+  - npm view clsx license
+accepted-cves: []
+---
+
+## Filter: license
+
+MIT — on the workspace allowlist.
+
+## Filter: types
+
+Ships first-party TypeScript types in its distribution.
+
+## Filter: maintenance
+
+Active. Maintained by Luke Edwards; stable, minimal API.
+
+## Filter: boundary-fit
+
+Core UI package. `clsx` is a utility for constructing `className` strings; appropriate for `core-ui`. No boundary rule violation.
+
+## Filter: shadow-check
+
+No competing className utility in the workspace. No shadow.
+
+## Filter: eu-residency
+
+Pure compute; no network calls or vendor data transmission. n/a.
+
+## Filter: cve-scan
+
+No advisories at adoption time.
+
+## Filter: named-consumer
+
+`core-ui` uses `clsx` in the `cn()` utility (combined with `tailwind-merge`) for conditional class composition.
+
+## Prompt: replaces
+
+Nothing — this is the initial UI scaffold.
+
+## Prompt: migration-cost-out
+
+Mechanical: replace `clsx()` calls with template literals or equivalent. Minimal API surface.
+
+## Prompt: alternatives-considered
+
+1. **classnames** — the older predecessor; `clsx` is smaller and faster.
+2. **Template literals** — verbose; no conditional logic support.
+`clsx` is the de-facto standard lightweight className utility.

turbo/generators/templates/core-package/ui/docs/library-decisions/2026-05-14-react.md.hbs

@@ -0,0 +1,66 @@
+---
+package: react
+version: "^19.0.0"
+tier: core
+decision: approved
+date: 2026-05-14
+deciders: [scaffolded]
+adr: null
+filter-results:
+  license: MIT
+  types: "@types/react"
+  maintenance: active
+  boundary-fit: pass
+  shadow-check: pass
+  eu-residency: n/a
+  cve-scan: clean
+  named-consumer: pass
+verification-commands:
+  - pnpm audit --audit-level=moderate
+  - npm view react license
+accepted-cves: []
+---
+
+## Filter: license
+
+MIT — on the workspace allowlist.
+
+## Filter: types
+
+TypeScript types via `@types/react` (community-maintained but canonical; ships in sync with each React major).
+
+## Filter: maintenance
+
+Active. Maintained by Meta; v19 is the current stable major.
+
+## Filter: boundary-fit
+
+Core UI package. React is required for the component library; appropriate for `core-ui`. No boundary rule violation.
+
+## Filter: shadow-check
+
+React is already workspace-present in app packages. Same major version; no shadow.
+
+## Filter: eu-residency
+
+Client-side rendering library; no vendor data transmission. n/a.
+
+## Filter: cve-scan
+
+No advisories at adoption time.
+
+## Filter: named-consumer
+
+`core-ui` renders all atomic-design components (Button, Input, Label, FormField) as React components.
+
+## Prompt: replaces
+
+Nothing — React is already the UI framework in the workspace.
+
+## Prompt: migration-cost-out
+
+Impossible: React is the foundational UI library for this workspace.
+
+## Prompt: alternatives-considered
+
+React is workspace-locked as the UI framework. No alternative evaluated.

turbo/generators/templates/core-package/ui/docs/library-decisions/2026-05-14-tailwind-merge.md.hbs

@@ -0,0 +1,68 @@
+---
+package: tailwind-merge
+version: "^3.0.0"
+tier: core
+decision: approved
+date: 2026-05-14
+deciders: [scaffolded]
+adr: null
+filter-results:
+  license: MIT
+  types: native
+  maintenance: active
+  boundary-fit: pass
+  shadow-check: pass
+  eu-residency: n/a
+  cve-scan: clean
+  named-consumer: pass
+verification-commands:
+  - pnpm audit --audit-level=moderate
+  - npm view tailwind-merge license
+accepted-cves: []
+---
+
+## Filter: license
+
+MIT — on the workspace allowlist.
+
+## Filter: types
+
+Ships first-party TypeScript types in its distribution.
+
+## Filter: maintenance
+
+Active. Maintained by dcastil; v3 is the current stable major.
+
+## Filter: boundary-fit
+
+Core UI package. `tailwind-merge` deduplicates conflicting Tailwind classes; appropriate for `core-ui`. No boundary rule violation.
+
+## Filter: shadow-check
+
+No competing Tailwind class-merging utility in the workspace. No shadow.
+
+## Filter: eu-residency
+
+Pure compute; no network calls or vendor data transmission. n/a.
+
+## Filter: cve-scan
+
+No advisories at adoption time.
+
+## Filter: named-consumer
+
+`core-ui` uses `tailwind-merge` in the `cn()` utility (combined with `clsx`) to resolve conflicting Tailwind class names at runtime.
+
+## Prompt: replaces
+
+Nothing — this is the initial UI scaffold.
+
+## Prompt: migration-cost-out
+
+Mechanical: replace `twMerge()` calls in the `cn()` utility; update any call sites. Narrow API surface.
+
+## Prompt: alternatives-considered
+
+1. **Custom deduplication** — error-prone; Tailwind has hundreds of class groups that change each version.
+2. **tw-join** — does not merge conflicts; only concatenates.
+`tailwind-merge` is the de-facto standard for conflict-free Tailwind class composition.