Let dogfood hooks resolve safeword eslint from source worktrees

[TheMostlyGreat]

Summary

Closes #470.

• Add a root safeword: workspace:* devDependency so bun install links the local CLI workspace at node_modules/safeword.
• Teach generated .safeword/eslint.config.mjs to load TypeScript project configs through jiti, while preserving native dynamic import for JS configs.
• Install jiti@^2.2.0 through the TypeScript pack package list and document the generated-config dependency.
• Add regression coverage for root safeword/eslint resolution, generated TS-config loading, package reconciliation, and base fixture dependency readiness.
• Refactor the new package spec into JITI_PACKAGE so production wiring and package-list tests share the same version-floor contract.
• Mark ticket commit-dogfood-hooks-without-package-link (CQ4CD3) done after explicit ready confirmation.

Verification

• node --input-type=module ... import('safeword/eslint')
• bunx eslint --config .safeword/eslint.config.mjs packages/cli/tests/integration/review-stamp.test.ts
• bunx eslint --config eslint.config.ts .safeword/hooks/lib/lint.ts --no-warn-ignored
• bun run --cwd packages/cli test tests/commands/check.test.ts tests/commands/self-verify.test.ts tests/integration/namespace-migration-upgrade.test.ts tests/integration/phase0-walkthrough.test.ts tests/reconcile.test.ts tests/schema.test.ts src/templates/config.test.ts tests/dogfood-source-worktree.test.ts
• bun run --cwd packages/cli test tests/reconcile.test.ts tests/schema.test.ts
• bun run --cwd packages/cli typecheck
• bun run lint
• bun run format:check
• bun run test:bdd
• bun run --cwd packages/cli build
• bun audit --json
• bun packages/cli/src/cli.ts sync-config --check
• bunx depcruise --output-type err --config .dependency-cruiser.cjs .
• bunx knip
• bunx jscpd . --min-lines 10 --reporters console
• git diff --check

Review

• Caught up to origin/main (b1355aff) before final validation.
• /quality-review checked current ESLint TypeScript config docs, Bun workspace docs, package versions, and bun audit --json.
• /refactor extracted JITI_PACKAGE after the audit/CI fixture fix; focused schema/reconcile tests passed and the refactor is isolated in commit d278b395.
• /audit found no PR-caused blockers: config sync and depcruise are clean, security audit has no advisories, configured docs sources are updated, and remaining knip/jscpd findings are pre-existing repo-wide debt.
• User confirmed readiness; ticket CQ4CD3 is now done in commit 31f3b9c6.