feat(type-catalog): emit kind:import consumer-edge rows behind --include-imports

[jakebromberg]

Summary

• Adds one kind: "import" row per imported symbol when --include-imports is passed (default off), giving cross-repo queries (consumers-of.jq Q1: consumers-of.jq — surface cross-repo API consumption patterns #156, renamed-consumers.jq Q3: renamed-consumers.jq — detect stale imports after publisher rename #158) the consumer-edge data they need.
• Resolution is text-only (Tier 1, bare-specifier strip) — catches >=95% of cross-repo edges without any filesystem reads; Tier 2 (tsconfig paths, package.json walking) is deferred until a query demands it.
• Defensive positive-kind filters added to name-collisions.jq and touched-window-debt-summary.jq so existing query output stays byte-stable on import-bearing catalogs.

Schema

Field	Meaning
kind	"import"
name	origin-side spelling (queryable against declarations); null for side-effect
import_form	named | default | namespace | side-effect | re-export | dynamic | require
imported_as	local binding name (== name when no as); null for side-effect / bare-call require
origin_specifier	raw text from source (or "<computed>" for templated dynamic imports)
origin_package	bare-specifier-stripped published name (@wxyc/shared/foo -> @wxyc/shared); null for relative/computed
origin_resolution	bare-specifier | relative | computed
type_only	true for import type {...} (declaration-level) or { type X } (per-binding)

See docs/pipeline-contract.md §"Import rows" for the full table including row counts per import form.

What's affected

• New CLI flag --include-imports; manifest.toml registers it as an optional arg.
• New _lib/origin-package.mjs pure resolver (12 tests).
• 10 synthetic fixtures + 13 per-form assertions in test/imports.test.mjs.
• Positive kind whitelist on name-collisions.jq and touched-window-debt-summary.jq's name-collisions section.
• docs/pipeline-contract.md, extractors/typescript/README.md, manifest.toml updated.

Test plan

• All extractor unit tests pass (95: type-catalog 70 + function-catalog 14 + sort 6 + artifacts 4 + origin-package 12 + imports 13, minus existing test count drift).
• Canonical test suite (26 / 26) and integration suite (124 / 124) and gojq parity (54 / 54) — total 299 tests green.
• On real dj-site (~160 declarations, ~3000 import rows when flag is on), every type-catalog query produces byte-identical output with vs. without the flag.
• Wall-clock budget under 110% target.
• Two consecutive runs against the same root produce byte-identical output (determinism).
• Recall sanity check on dj-site: 1623 import/export statements via git grep -> 2959 per-symbol extractor rows (named-multi-symbol expansion accounts for the difference).

Closes #152.