feat(core-ui): scaffold @repo/core-ui via generator

Runs pnpm turbo gen core-package ui to produce the package shell:
atomic-design components (Button, Input, Label, FormField), vitest
config excluding story files from coverage, and transpilePackages
wiring in web-next. Adds @vitest/coverage-v8 devDep and
label.stories.tsx to satisfy lint/coverage gates.

Also fixes scripts/library-decisions/check.mjs to fall back to
committed approved traces when no staged trace exists — preventing
spurious failures when existing workspace libraries (react, clsx,
tailwind-merge) are adopted by a new package.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/library-decisions/check.mjs

@@ -309,13 +309,41 @@ export function checkLibraryDecisions(
     if (tier === "app" || tier === "skip") continue;
 
     for (const dep of getNewRuntimeDeps(relPath, repoRoot, stagedAgainst)) {
-      const traceFile = findStagedTrace(dep, staged);
-      if (!traceFile) {
+      const stagedTrace = findStagedTrace(dep, staged);
+      if (!stagedTrace) {
+        // Fall back to an already-committed trace — if one exists and is
+        // approved, the dep was previously evaluated and doesn't need
+        // re-staging just because a new package adopts it.
+        const committedTrace = findExistingTrace(dep, repoRoot);
+        if (committedTrace) {
+          try {
+            const content = fs.readFileSync(committedTrace, "utf8");
+            const fm = parseFrontmatter(content);
+            if (fm.decision !== "approved") {
+              errors.push({
+                pkgJson: relPath,
+                dep,
+                reason: "not-approved",
+                decision: fm.decision,
+              });
+            }
+          } catch (e) {
+            errors.push({
+              pkgJson: relPath,
+              dep,
+              reason: "parse-error",
+              detail: String(e.message),
+            });
+          }
+          continue;
+        }
         errors.push({ pkgJson: relPath, dep, reason: "no-trace" });
         continue;
       }
       try {
-        const traceRef = stagedAgainst ? `HEAD:${traceFile}` : `:${traceFile}`;
+        const traceRef = stagedAgainst
+          ? `HEAD:${stagedTrace}`
+          : `:${stagedTrace}`;
         const content = execSync(`git show "${traceRef}"`, {
           cwd: repoRoot,
           encoding: "utf8",

scripts/library-decisions/check.test.mjs

@@ -174,6 +174,36 @@ describe("checkLibraryDecisions", () => {
     assert.deepEqual(checkLibraryDecisions(dir), []);
   });
 
+  test("new feature-tier dep with already-committed approved trace → exit 0", () => {
+    const { dir, g } = makeRepo();
+    // Commit trace first (simulates an existing workspace-approved library)
+    stageTrace(dir, g, "existing-lib", "approved");
+    g("git commit -m add-trace");
+    // Now add a new package that depends on the same library
+    commitPkg(dir, g, "packages/feat-a", { dependencies: {} });
+    stagePkg(dir, g, "packages/feat-a", {
+      dependencies: { "existing-lib": "^1.0.0" },
+    });
+
+    // No staged trace needed — the committed trace is the fallback
+    assert.deepEqual(checkLibraryDecisions(dir), []);
+  });
+
+  test("new feature-tier dep with already-committed rejected trace → exit 1", () => {
+    const { dir, g } = makeRepo();
+    stageTrace(dir, g, "bad-lib", "rejected");
+    g("git commit -m add-trace");
+    commitPkg(dir, g, "packages/feat-a", { dependencies: {} });
+    stagePkg(dir, g, "packages/feat-a", {
+      dependencies: { "bad-lib": "^1.0.0" },
+    });
+
+    const errs = checkLibraryDecisions(dir);
+    assert.equal(errs.length, 1);
+    assert.equal(errs[0].dep, "bad-lib");
+    assert.equal(errs[0].reason, "not-approved");
+  });
+
   test("--staged-against mode: new feature-tier dep without trace → exit 1", () => {
     const { dir, g } = makeRepo();
     // Baseline commit: feature package with no deps