chore(sync): cascade schema split (kind → layout + native)

socket-repo-template's per-repo config schema was split:
  kind: 'X'  →  layout: 'Y' + native: 'Z'

The single `kind` enum collapsed two unrelated dimensions; splitting
makes both queryable. ultrathink is reclassified as native:none (its
per-language ports live in lockstep.json lang-parity rows, not via
release-checksums infra).

Synced from socket-repo-template via:
  node scripts/sync-scaffolding.mts --target . --fix

Files refreshed:
- .config/socket-repo-template.json    (kind → layout + native)
- .config/socket-repo-template-schema.json  (regenerated)
- scripts/socket-repo-template-schema.mts   (TypeBox source)
- lockstep.schema.json                  (perfectionist pass: more
                                        descriptions, tighter regexes,
                                        FULL_SHA_PATTERN constant)
- scripts/lockstep-schema.mts           (TypeBox source for above)
- .claude/skills/_shared/skill-authoring.md  (updated reference table)

DISABLE_PRECOMMIT_TEST=1 — sync operation, not feature work.
Format auto-applied via `pnpm run fix` to satisfy per-repo oxfmt
profile.

Author: jdalton

.claude/skills/_shared/skill-authoring.md

@@ -87,6 +87,22 @@ The Anthropic docs codify several rules; honor them:
 - Prefer **gerund form** for the name (`processing-pdfs`, `scanning-quality`); noun-phrase (`pdf-processing`) and verb-imperative (`process-pdfs`) are acceptable alternatives, but pick one and be consistent across the fleet.
 - Use forward slashes in any path the skill references — never backslashes, even in docs that target Windows users.
 
+## Fleet repo references
+
+When scaffolding a new fleet repo, or when a sync question arises ("how does the fleet do X?"), mimic the reference that matches both axes (`layout` + `native`) in `.config/socket-repo-template.json`:
+
+| layout × native | Best reference | Notes |
+|---|---|---|
+| `single-package` × `none` | **`socket-packageurl-js`** or **`socket-sdk-js`** | Clean `pnpm-workspace.yaml`, canonical `scripts/{check,fix,clean,cover,security,update,lockstep,build}.mts`, simple `lockstep.json` with empty `rows`. |
+| `monorepo` × `producer` | **`socket-btm`** | 10+ packages (`build-infra`, per-tool-builder workspaces), deep `pnpm --filter` patterns, full `packages: [packages/*, .claude/hooks/*]`, richer catalog, lockstep + submodules + native release matrix. The canonical "monorepo done right" reference. |
+| `monorepo` × `consumer` | **`socket-cli`** | 3-package layout (`build-infra`, `cli`, `package-builder`); consumes prebuilts from socket-btm. |
+| `monorepo` × `none` | `socket-registry` | Mono npm publish path, no native artifacts via the fleet's release-checksums infra. |
+| `monorepo` × `none` + lang-parity | `ultrathink` | Per-language ports tracked entirely in `lockstep.json` `lang-parity` rows, not via release-checksums. Each port has its own build matrix. |
+| Library with vendored upstreams | `socket-lib` | Shows `packages: [.claude/hooks/*, tools/*, vendor/*]`, vendored-as-workspace pattern. |
+| Skill marketplace / no real build graph | `skills` | Dep-free shims for `clean.mts` / `cover.mts` are acceptable; document the deviation in the script's header. |
+
+**Don't cross axes when picking a reference.** A `single-package` × `none` repo (`socket-lib`) and a `monorepo` × `consumer` repo (`socket-cli`) ship very different `scripts/*.mts` shapes — `socket-cli`'s scripts assume `packages/` and `pnpm --filter`, which break in a single-package repo. Match both axes.
+
 ## References
 
 Authoritative upstream docs — keep these as the source of truth, mirror their guidance here only when fleet specifics demand it:

.config/socket-repo-template-schema.json

@@ -2,9 +2,9 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/SocketDev/socket-repo-template-schema.json",
   "title": "socket-repo-template per-repo config",
-  "description": "Per-repo socket-repo-template config. Canonical path: `.config/socket-repo-template.json` (legacy: `.socket-repo-template.json` at the repo root).",
+  "description": "Per-repo socket-repo-template config. Two valid locations: `.config/socket-repo-template.json` (primary) or `.socket-repo-template.json` at the repo root (alternative). Both are first-class — pick the location that fits your repo's convention.",
   "type": "object",
-  "required": ["schemaVersion", "repoName", "kind"],
+  "required": ["schemaVersion", "repoName", "layout", "native"],
   "properties": {
     "$schema": {
       "description": "JSON Schema reference for editor autocompletion. Conventionally `./socket-repo-template-schema.json` — both the config and its schema live side-by-side in `.config/`.",
@@ -17,18 +17,27 @@
     },
     "repoName": {
       "pattern": "^[a-z0-9][a-z0-9-]*$",
-      "description": "Canonical repo basename (e.g. `socket-lib`, `ultrathink`). Used for kind-independent exemptions like the oxlint `socket-lib` carve-out.",
+      "description": "Canonical repo basename (e.g. `socket-lib`, `ultrathink`). Used for layout / native-independent exemptions like the oxlint `socket-lib` carve-out.",
       "type": "string"
     },
-    "kind": {
-      "description": "Fleet repo category. Determines which opt-in files the repo must ship and which it must not. See README.md \"Fleet kinds\" for the table.",
+    "layout": {
+      "description": "Package layout. `single-package` = one `package.json` at root, no `packages/`. `monorepo` = pnpm workspaces under `packages/`.",
       "anyOf": [
         {
           "const": "single-package",
           "type": "string"
         },
         {
-          "const": "mono-no-native",
+          "const": "monorepo",
+          "type": "string"
+        }
+      ]
+    },
+    "native": {
+      "description": "Native-binary supply-chain role. `none` = pure-npm publish path. `consumer` = pulls prebuilt binaries from a sibling producer. `producer` = ships native artifacts via GH releases. `both` = consumes one set, produces another. (Per-language ports live in `lockstep.json` `lang-parity` rows, not here.)",
+      "anyOf": [
+        {
+          "const": "none",
           "type": "string"
         },
         {
@@ -42,10 +51,6 @@
         {
           "const": "both",
           "type": "string"
-        },
-        {
-          "const": "lang-ports",
-          "type": "string"
         }
       ]
     },

.config/socket-repo-template.json

@@ -2,7 +2,8 @@
   "$schema": "./socket-repo-template-schema.json",
   "schemaVersion": 1,
   "repoName": "vscode-socket-security",
-  "kind": "single-package",
+  "layout": "single-package",
+  "native": "none",
   "hooks": {
     "enablePrePush": true,
     "enableCommitMsg": true,