refactor(repo): restructure into crates/ workspace and rename folders for clarity

Consolidate the confusing top-level layout:
- core/      -> stdlib/                  (RSScript stdlib .rssi interfaces)
- rss/       -> packages/                (first-party RSScript packages)
- benchmark/ + benchmarks/ -> benchmarks/{micro,packages}/
- demos/     -> examples/demos/          (s3-iam-reir hero demo)
- docs/ + specs/ -> docs/                (single documentation root)
- main crate + lsp/runtime/reir/native-abi/vm-jit -> crates/*
  (root Cargo.toml is now a virtual workspace manifest)

Rewire every path reference: build.rs workspace-root walker, interfaces.rs
include_str! stdlib paths, rsspkg.lock source paths, Cargo workspace members,
native crate relative path-deps (depth-adjusted), generated test fixtures,
runtime/native-abi locators, and test helpers (workspace_root / fixture_root /
runtime_path). Fix the capability-taxonomy gate that had silently become a
no-op under the nested-crate layout.

Full suite green: 1200 passed, 0 failed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Haofei

.github/actions/rsscript-review/action.yml

@@ -69,7 +69,7 @@ runs:
         else
           # Ambient binaries are not provenance-pinned. For a protected gate, pin
           # this action to a release SHA so the toolchain is built from that ref.
-          echo "::warning::Using rss/reir already on PATH. These are not provenance-pinned; pin this action to a release SHA for a trusted supply-chain gate ($(command -v rss), $(command -v reir))."
+          echo "::warning::Using packages/reir already on PATH. These are not provenance-pinned; pin this action to a release SHA for a trusted supply-chain gate ($(command -v rss), $(command -v reir))."
         fi
 
     - name: Run RSScript and REIR review

.github/workflows/rsscript-review-action.yml

@@ -21,7 +21,7 @@ jobs:
         uses: ./.github/actions/rsscript-review
         with:
           head: examples/packages/code-agent
-          grants: demos/s3-iam-reir/expected/prod-grants.reir.json
+          grants: examples/demos/s3-iam-reir/expected/prod-grants.reir.json
           target: prod
           post-comment: false
           fail-on-missing: false

Cargo.toml

@@ -1,58 +1,20 @@
-[package]
-name = "rsscript"
-version = "0.1.0"
-edition = "2024"
-description = "Reviewable System Script v0.6 review-first front-end checker and Rust lowering prototype"
-license = "MIT OR Apache-2.0"
-
 [workspace]
+resolver = "3"
 members = [
-    "lsp",
-    "runtime",
-    "reir",
-    "native-abi",
-    "vm-jit",
-    "rss/core/cli/native/rust",
-    "rss/core/crypto/native/rust",
-    "rss/core/http-server/native/rust",
-    "rss/rayon/native/rust",
-    "rss/adapters/sqlite/native/rust",
-    "rss/adapters/sqlx-ffi/native/rust",
+    "crates/rsscript",
+    "crates/lsp",
+    "crates/runtime",
+    "crates/reir",
+    "crates/native-abi",
+    "crates/vm-jit",
+    "packages/core/cli/native/rust",
+    "packages/core/crypto/native/rust",
+    "packages/core/http-server/native/rust",
+    "packages/rayon/native/rust",
+    "packages/adapters/sqlite/native/rust",
+    "packages/adapters/sqlx-ffi/native/rust",
 ]
 
-[[bin]]
-name = "rss"
-path = "src/main.rs"
-
-[dependencies]
-reir = { path = "reir" }
-rss-native-abi = { path = "native-abi", features = ["host"] }
-serde = { version = "1", features = ["derive"] }
-serde_json = { version = "1", features = ["preserve_order"] }
-sha2 = "0.10"
-regex = "1"
-toml = "0.8"
-serde_yaml_ng = "0.10"
-base64 = "0.22"
-chrono = { version = "0.4", default-features = false, features = ["alloc"] }
-hex = "0.4"
-hmac = "0.12"
-percent-encoding = "2"
-rand = "0.8"
-uuid = { version = "1", features = ["v4"] }
-vm-jit = { path = "vm-jit", optional = true }
-
-[features]
-# Native (Cranelift) baseline JIT for the integer/control core. Off by default so
-# normal builds/tests don't pull in the codegen dependency; enable for the
-# native differential backend, `rss bench --mode jit-native`, and force-JIT CI.
-native-jit = ["dep:vm-jit"]
-
-[build-dependencies]
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-toml = "0.8"
-
 # Release tuning for the `rss` tool / VM. Thin LTO + a single codegen unit let the
 # optimizer inline across the interpreter's hot dispatch/value helpers, which are
 # spread across modules. Small but real on the interpreter (~3% on numeric loops);
@@ -61,14 +23,3 @@ toml = "0.8"
 [profile.release]
 lto = "thin"
 codegen-units = 1
-
-[dev-dependencies]
-sha1 = "0.10"
-libtest-mimic = "0.8"
-proptest = "1"
-
-# The differential corpus runner uses a custom (libtest-mimic) harness so each
-# fixture is an individually named, filterable test case.
-[[test]]
-name = "corpus"
-harness = false