fix review findings: skip lib/ build-output refs in verify-package-paths; resolve acp built-bin npm deps from the declaring package

verify-package-paths flagged the new built-bin smokes' `lib/bin.js` citations
as stale-source drift, failing CI: doc-sync runs BEFORE build, so the build
output is absent at lint time. The gate targets moved SOURCE paths, so skip any
reference whose target goes through a `lib/` segment — mirroring how the file
scan already excludes `lib/`.

The acp built-bin smoke resolved `zod`/`@agentclientprotocol/sdk` via
`import.meta.resolve` from the test file's own context, but `acp-agent` does not
declare them — `dsh-acp` does. Under pnpm's strict layout they are not exposed
where the test resolves, so the new CI built-bin step failed with
"Cannot find package 'zod'". Resolve each from the `ui/acp` package URL (the one
that declares it) instead.

scripts/verify-package-paths.ts

@@ -28,6 +28,10 @@
  * Scope mirrors the other doc gates plus repo-authored TypeScript: Markdown
  * across README/docs/packages/AGENTS, and `.ts` under packages/** and
  * examples/** (excluding built `lib/`, `*.d.ts`, and vendored upstream source).
+ * A reference whose target path goes through a `lib/` segment is also skipped:
+ * that is a build OUTPUT (`packages/ui/acp-agent/lib/bin.js`), emitted only by
+ * `pnpm run build`, which CI runs AFTER this gate — flagging it would be a false
+ * positive on a path that is correct but not yet on disk.
  *
  * Run: `tsx scripts/verify-package-paths.ts`.
  */
@@ -111,6 +115,13 @@ function findViolations(absPath: string): Violation[] {
       // class may have swallowed (`packages/core/tools.` / `…/tools/`).
       const ref = m[0].replace(/[./]+$/, '')
       if (existsSync(resolve(root, ref))) continue
+      // A reference INTO a package's built `lib/` is a build-output path, not an
+      // authored-source location: it does not exist until `pnpm run build` emits
+      // it, and CI runs this gate BEFORE the build step. This gate reports stale
+      // SOURCE paths (a moved package), so skip `lib/` targets the same way the
+      // file scan excludes `lib/` files — a `packages/ui/acp-agent/lib/bin.js`
+      // citation in a built-bin smoke is correct, just not yet on disk at lint.
+      if (ref.split('/').includes('lib')) continue
       // Only a stale path to a REAL (moved) package is a violation; a segment
       // matching a live package name is the drift signal.
       const segments = ref.split('/').slice(1)