Phase 11 of the provider-parity plan. Cognito now writes a
provider-neutral migration package alongside the existing loose-CSV
output.

- New \`src/providers/cognito/package-exporter.ts\` orchestrates the
  package output. Handles user-pool, connection, and none org
  strategies; defaults to user-pool (one WorkOS org per Cognito user
  pool). Federated/JIT users (userStatus=EXTERNAL_PROVIDER) are skipped
  by default in package mode.
- SSO handoff reuses \`src/sso/handoff.js\` to emit canonical
  \`sso/saml_connections.csv\`, \`sso/oidc_connections.csv\`,
  \`sso/custom_attribute_mappings.csv\`, and \`sso/proxy_routes.csv\`.
  Raw provider snapshots land under \`raw/cognito-providers.jsonl\`.
- \`workos_upload/\` projection is written from the same source IDs as
  the package files. When the connection org strategy is used,
  memberships drop to a header-only file with a structured warning so
  importers know not to expect membership rows.
- CognitoClient gains \`exportPackage()\` while keeping the existing
  \`exportEntities()\` flow untouched. \`export-cognito\` CLI grows
  \`--package\` and \`--org-strategy\` flags; loose mode (the previous
  default) still produces \`workos_saml_connections.csv\`,
  \`workos_oidc_connections.csv\`, \`custom_attribute_mappings.csv\`,
  and \`workos_users.csv\`.
- Tests cover federated user skipping, manifest generation, SAML/OIDC
  handoff, custom attribute mapping, and the connection org strategy
  warning path.
- README documents the package flow and points at \`import-package\`.