[Stage 1.7] Enforce workspace boundaries and finalize the v2 CI and release gates

[draedful]

Parent: #318

Goal

Turn the workspace, package, and release boundaries established in Stage 1 into enforceable v2 repository rules.

Scope

• Add ESLint restrictions for cross-package source imports and imports from private packages by applications.
• Add a dependency-graph check for forbidden directions and cycles.
• Require the agreed pnpm workspace protocol.
• Make CI install with a frozen pnpm lockfile.
• Run linting, type checking, unit tests, production builds, package metadata checks, and tarball consumer checks.
• Build Storybook and run Playwright E2E against package entry points.
• Ensure CI and release jobs do not bypass packages through source aliases.
• Verify that release-v2.yml publishes only intended public packages.
• Verify that v2 prereleases remain under next and cannot update latest.
• Verify every public entry point present at the approved split commit or added by an approved synchronized v1 contract change, including @gravity-ui/graph/playwright when applicable.
• Update and verify required-check contexts in the v2 ruleset when CI job names change, without leaving merges permanently blocked.
• Document required local verification commands.

Acceptance criteria

• A cross-package source import fails an automated check.
• A forbidden dependency direction or package cycle fails CI.
• CI validates packed public artifacts in isolated consumers.
• Storybook and E2E run against public package entry points.
• All required checks run from a clean checkout with a frozen lockfile.
• Private packages cannot be published or leak into public runtime dependencies.
• The v2 release workflow and next dist-tag guards are required release gates.
• Required-check contexts in the v2 ruleset match the final CI job names and do not leave valid pull requests permanently blocked.
• The documented local verification command reproduces required CI checks.
• All Stage 1 exit criteria are satisfied or linked to explicit follow-up work.