feat: add xport lock-step manifest (#625)

Adds the xport tooling shared across the Socket fleet for declaring
cross-repo lockstep dependencies (gitlinks, package versions).

Files:
  scripts/xport.mts           — runner
  scripts/xport-schema.mts    — TypeBox source of truth
  scripts/xport-emit-schema.mts — generates xport.schema.json
  xport.schema.json           — machine-generated, used by validators
  package.json                — adds @sinclair/typebox 0.34.49 devDep
  pnpm-lock.yaml              — refreshed for typebox

Self-landable; no consumer of xport in this repo yet, but the schema
emit + manifest validation can run in pnpm check once wired.

Author: jdalton

package.json

@@ -66,6 +66,7 @@
   },
   "devDependencies": {
     "@anthropic-ai/claude-code": "2.1.92",
+    "@sinclair/typebox": "0.34.49",
     "@babel/generator": "7.28.5",
     "@babel/parser": "7.26.3",
     "@babel/traverse": "7.26.4",

pnpm-lock.yaml

@@ -0,0 +1,37 @@
+/**
+ * @fileoverview Emit `xport.schema.json` from the TypeBox schema.
+ *
+ * The TypeBox schema in `scripts/xport-schema.mts` is the source of truth.
+ * TypeBox schemas are JSON Schema natively — no conversion library needed,
+ * just serialize the schema object and add the draft-2020-12 meta headers.
+ *
+ * Run via `pnpm run xport:emit-schema` when the schema changes.
+ */
+
+import { writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { getDefaultLogger } from '@socketsecurity/lib/logger'
+
+import { XportManifestSchema } from './xport-schema.mts'
+
+const logger = getDefaultLogger()
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootDir = path.resolve(__dirname, '..')
+const outPath = path.join(rootDir, 'xport.schema.json')
+
+// TypeBox schemas carry JSON Schema shape directly, plus a Symbol-keyed
+// [Kind] marker that JSON.stringify drops. Spreading the schema first
+// then layering the canonical $schema / $id / title on top gives a clean
+// draft-2020-12 document with the Socket-specific headers.
+const enriched = {
+  $schema: 'https://json-schema.org/draft/2020-12/schema',
+  $id: 'https://github.com/SocketDev/xport.schema.json',
+  title: 'xport lock-step manifest',
+  ...XportManifestSchema,
+}
+
+writeFileSync(outPath, JSON.stringify(enriched, null, 2) + '\n', 'utf8')
+logger.success(`wrote ${path.relative(rootDir, outPath)}`)