Define the source-pinned Krad component graph

[keys-i]

Closes #1

Motivation

Establish the smallest auditable package boundary for the researched compiler, utilities, libc, and runtime libraries without vendoring upstream source trees.

Changes

• create a private Node workspace for packages/*
• define krad-clang, krad-utils, krad-musl, and krad-libs
• pin each component to an HTTPS origin, full commit, license, and focused source paths
• validate metadata and produce deterministic dependency order with missing/cycle failures

Verification

• all component JavaScript passed node --check
• the completed stack passed npm test with 3/3 tests
• the completed stack verified all four exact local research revisions

Risk and rollback

This is metadata and validation only; it does not publish packages or vendor/build upstream code. Roll back by reverting commit 2abfc51.

Stack

Base: bootstrap. The verifier PR targets this branch.