Standardize package CLI folder layout

[artiphishle]

What changed

• add the Doctor rules package.cli.root-file.disallowed and package.cli.index.required
• reject package-root src/cli.ts files
• require src/cli/index.ts when a package exposes an Ankh provider or ./cli export
• apply the policy consistently through both the standalone Doctor CLI and the Ankh runtime provider
• move Doctor's standalone executable to src/cli/standalone.ts
• keep the provider at src/cli/index.ts
• update package metadata, public exports, generated usage docs, and regression tests

Companion migrations

The remaining real root-CLI violations are handled by:

• Move standalone CLI into src/cli templates#122
• Move standalone CLI into src/cli paradox#66

Recommended merge order: merge those two companion PRs first, then merge this owning Doctor PR so #8 closes only after the organization is compliant.

No compatibility file, bridge, alias, or deprecated src/cli.ts entrypoint is retained.

Validation

Standard PR CI is green:

• build
• type-check
• lint
• format check
• Knip
• tests
• generated docs
• changeset status

Closes #8