chore(workspace): register tools/* + vendor/* as workspace packages

Adds two workspace globs to pnpm-workspace.yaml so internal developer
utilities can declare workspace dependencies without brittle relative
paths:

- tools/* — developer-only utilities (audits, codemods, scripts).
  Not published, not part of the dist tree.
- vendor/* — vendored upstream code shipped as workspace packages so
  tools can reference it via `workspace:*` instead of
  `../../../vendor/...`.

Adds matching infrastructure entries so vendor/ + tools/ never leak
into linter, formatter, size-check, or published-exports output:

- .oxfmtrc.json: skip **/vendor.
- .oxlintrc.json: skip **/vendor.
- scripts/validate/file-size.mts: skip 'vendor' in SKIP_DIRS.
- scripts/fix/generate-package-exports.mts: ignore tools/** and
  vendor/** so the published @socketsecurity/lib package.json
  doesn't pick up developer-tool exports on every regen.

Setup for the prim primordials-audit tool landing in a follow-up
commit.

Author: jdalton

.oxfmtrc.json

@@ -33,6 +33,8 @@
     "perf/**/fixtures",
     "scripts/templates",
     "test/**/fixtures",
-    "test/**/packages"
+    "test/**/packages",
+    "tools/**/node_modules",
+    "**/vendor"
   ]
 }

.oxlintrc.json

@@ -56,6 +56,7 @@
     "**/patches",
     "**/test/fixtures",
     "**/test/packages",
+    "**/vendor",
     "**/*.d.ts",
     "**/*.d.ts.map",
     "**/*.tsbuildinfo"

pnpm-workspace.yaml

@@ -1,8 +1,17 @@
 # Register .claude/hooks/* as workspace packages so taze (run via
 # `pnpm run update`) sees and bumps their package.json manifests
 # alongside the root. Keeps hook deps in lockstep with the main tree.
+#
+# tools/* — developer-only utilities (audit/codemod scripts). Not
+# published, not part of the dist tree.
+#
+# vendor/* — vendored upstream code shipped as workspace packages so
+# tools can reference it via `workspace:*` instead of brittle
+# `../../../vendor/...` relative paths.
 packages:
   - .claude/hooks/*
+  - tools/*
+  - vendor/*
 
 allowBuilds:
   esbuild: true

scripts/fix/generate-package-exports.mts

@@ -81,6 +81,10 @@ async function main(): Promise<void> {
         'dist/external/**',
         'scripts/**',
         'src/**',
+        // tools/ and vendor/ are workspace packages for internal use,
+        // not public exports of @socketsecurity/lib.
+        'tools/**',
+        'vendor/**',
         // Files prefixed with _ are private helpers, not public API.
         'dist/**/_*',
       ],

scripts/validate/file-size.mts

@@ -37,6 +37,7 @@ const SKIP_DIRS = new Set([
   '.vercel',
   '.vscode',
   'tmp',
+  'vendor',
 ])
 
 /**