feat(core-realtime): scaffold realtime optional core

Generator-emitted scaffold (pnpm turbo gen core-package realtime) plus
the story-00-precedent coverage repairs (coverage provider devDep,
symbols.ts exclude + tested allowlist mirror) and three minimal tests
covering generator-emitted realtime code the template suite misses.
Squash of 31d85e0 + review-fix cf11b38.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

packages/core-eslint/rules/no-realtime-handler-reexport.js

@@ -0,0 +1,48 @@
+// packages/core-eslint/rules/no-realtime-handler-reexport.js
+// Realtime handlers are private. A feature's realtime/handlers/*.handler.ts
+// must only be wired in the feature's own bind-production / bind-dev-seed files.
+// They must never be re-exported from barrel files or other public surfaces.
+
+const BIND_FILE = /\bdi\/bind-(?:production|dev-seed)\b/;
+const REALTIME_HANDLERS_IN_SOURCE = /\/realtime\/handlers\//;
+const HANDLERS_IN_SOURCE = /\/handlers\//;
+const REALTIME_IN_FILENAME = /\/realtime\//;
+
+export default {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "Block re-exports of realtime/handlers/** outside feature bind-* files (ADR-016 R1)",
+    },
+    messages: {
+      noRealtimeHandlerReexport:
+        "Realtime handlers (realtime/handlers/*.handler.ts) must not be re-exported (ADR-016 R1). " +
+        "Wire them only inside the feature's own bind-production / bind-dev-seed files.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const filename = context.filename ?? context.getFilename();
+
+    // Bind-* files are the only allowed place for these exports/imports
+    if (BIND_FILE.test(filename)) return {};
+
+    function checkExportSource(node) {
+      if (!node.source) return;
+      const source = node.source.value;
+      const isRealtimeHandler =
+        REALTIME_HANDLERS_IN_SOURCE.test(source) ||
+        (HANDLERS_IN_SOURCE.test(source) &&
+          REALTIME_IN_FILENAME.test(filename));
+      if (isRealtimeHandler) {
+        context.report({ node, messageId: "noRealtimeHandlerReexport" });
+      }
+    }
+
+    return {
+      ExportNamedDeclaration: checkExportSource,
+      ExportAllDeclaration: checkExportSource,
+    };
+  },
+};