#563 feat(sdk): own schema primitives and modernize init prefixes

Summary

• move the complete schema inspection/mutation engine into src/sdk/schema.ts, leaving the CLI command as a compatibility re-export and routing SDK/MCP runtime dispatch through the SDK owner
• remove 17 CLI private-core boundary edges, prune four stale schema suppressions, and tighten the hard ESLint suppression budget from 174 to 170
• add pm init --id-prefix <value> with --prefix alias, positional compatibility, equivalent-input normalization, deterministic conflict guidance, contracts, bash/zsh/fish completion, and docs
• reconcile GitHub dependency/security state and preserve the package-owned changelog generated by pm-changelog@2026.7.14-2

pm items

• pm-3mna — public SDK schema/config/profile/init promotion — schema ownership delivered; broader program remains open
• pm-9x6e — zero SDK import-boundary capstone — 17 schema edges removed; remaining domains stay open
• pm-nmzx — GH-562 init id-prefix flag — completed

Verification

• node scripts/run-tests.mjs coverage: 290 files, 5,701 tests, exact 100% statements (36,848/36,848), branches (26,463/26,463), functions (7,438/7,438), and lines (35,963/35,963)
• pnpm typecheck, pnpm lint:eslint, pnpm lint:duplicates, pnpm quality:static, pnpm quality:docs-skills, pnpm contracts:check
• pnpm security:scan, pnpm audit --audit-level high, pnpm version:check
• packed npm smoke plus fresh external consumer: installed tarball, initialized a temporary vcs- workspace, registered a custom ChangeSet type through the installed CLI, and created/read it through installed PmClient
• 88-command package-first dogfood passed
• tracker-aware linked acceptance tests passed for all three pm items
• live GitHub Dependabot/code-scanning/secret-scanning APIs each report zero open alerts
• telemetry is healthy (finish_error_rate_pct=0.34, zero failures missing error_code); strict Sentry release readiness remains independently blocked by the already tracked external integration issues pm-d4ns / PM-CLI-2B and pm-7n5a / PM-CLI-29, neither introduced or modified by this branch

---

Summary by cubic

Moves schema inspection and mutation into SDK-owned primitives and adds canonical --id-prefix/--prefix to pm init with robust, cross‑platform validation. This reduces CLI/MCP coupling and fixes the init prefix UX.

• Refactors

  • Schema engine now lives in src/sdk/schema.ts; the CLI schema command is a thin adapter and CLI/MCP calls route through the SDK for consistent behavior.
  • Removed 17 private-core import edges and tightened the ESLint suppression budget from 174 to 170.

• Bug Fixes

  • GH-562: Added pm init --id-prefix with --prefix alias. Accepts flag or positional input; rejects path-like values (including Windows drive-relative like C:tracker) and conflicting inputs with clear guidance. Updated shell completions, runtime flag contracts, and docs.
  • Centralized schema initialization guards and standardized warning finalization across mutation results.