chore(tools/prim): add pnpm prim script + fix install docs

Adds a `prim` script to root package.json so `pnpm prim <subcommand>`
runs the tool from inside socket-lib without typing the full bin path.
This is the canonical way to invoke the tool during fleet development.

Why a script instead of relying on pnpm's bin-linking: pnpm doesn't
auto-link bins of workspace packages that no other workspace depends
on. `prim` is a no-consumer tool (it audits sibling repos), so
`node_modules/.bin/prim` never gets created and `pnpm exec prim`
fails with "Command not found." A root script side-steps that.

README fixes:
- Drop the misleading `pnpm dlx prim` line. The package is
  `"private": true` and won't ever be on npm.
- Document `pnpm prim` as the in-repo entry point, with
  `node /path/to/socket-lib/tools/prim/bin/prim.mts` as the
  out-of-repo fallback.
- Update all inline examples to use `pnpm prim` (was `prim`).

Author: jdalton

package.json

@@ -699,6 +699,7 @@
     "dev": "node scripts/build/main.mts --watch",
     "fix": "node scripts/fix.mts",
     "lint": "node scripts/lint.mts",
+    "prim": "node tools/prim/bin/prim.mts",
     "security": "agentshield scan && { command -v zizmor >/dev/null && zizmor .github/ || echo 'zizmor not installed — run pnpm run setup to install'; }",
     "prepare": "husky && node scripts/build/main.mts --quiet",
     "prepublishOnly": "pnpm run build",

tools/prim/README.md

@@ -23,42 +23,50 @@ use primordials, and a state file for tracking progress across runs.
 
 ## Install
 
+`prim` is a workspace-only tool — it isn't published to npm and never will be (`"private": true`). Two ways to run it:
+
 ```sh
-# Local checkout, run directly:
+# From inside socket-lib, use the root pnpm script:
+pnpm prim --help
+pnpm prim coverage --target ../socket-cli
+
+# From outside socket-lib (e.g. when auditing a sibling repo), invoke
+# the bin directly:
 node /path/to/socket-lib/tools/prim/bin/prim.mts --help
 ```
 
-Once published to npm, `pnpm dlx prim` will work too.
+The `pnpm prim` form is the canonical way to run it during fleet
+development — it always picks up the live source under `tools/prim/`.
 
 ## Usage
 
 `prim` is a multi-command CLI. Each subcommand does one thing.
 
 ```sh
 # Show help
-prim --help
+pnpm prim --help
 
 # Find call sites you could migrate today (existing primordials)
-prim coverage --target ./socket-cli --dir dist
+pnpm prim coverage --target ../socket-cli --dir dist
 
 # Find gaps in the primordials surface (need socket-lib expansion)
-prim gaps --target ./socket-cli
+pnpm prim gaps --target ../socket-cli
 
 # Both at once, as a snapshot
-prim audit --target ./socket-cli --update-state
+pnpm prim audit --target ../socket-cli --update-state
 
 # Inspect persisted state
-prim state
+pnpm prim state
 
 # Dry-run a codemod over your source tree
-prim mod --target . --dir src
+pnpm prim mod --target . --dir src
 
 # Apply for real (only after reviewing the dry-run!)
-prim mod --target . --dir src --apply
+pnpm prim mod --target . --dir src --apply
 
 # Also rewrite prototype-method calls where the receiver type is
 # guessed from the variable name (more aggressive — needs review)
-prim mod --target . --dir src --include-guessed --apply
+pnpm prim mod --target . --dir src --include-guessed --apply
 ```
 
 ### Subcommands