Fix stale blame-ignore hash and add-a-package lint step

[Mearman]

Two independent gaps found on main at 8a70023f, one commit each.

.git-blame-ignore-revs named a rewritten commit

The recorded hash was the reformat commit as it existed on its own branch. Rebase-merging that branch onto main rewrote it, so git merge-base --is-ancestor <sha> HEAD fails and blame resolves nothing — the 1191-file whole-tree reformat was blameable again with nothing to signal it.

Now points at c12e7402, verified an ancestor of HEAD. I checked it's the only style: format the workspace commit in current history, so there's no ambiguity about which one it should be.

The note above the entry is also corrected, because it's what let this recur: it blamed local rebases alone, and suggested matching by subject line. A stale hash still names a real commit in the reflog, so grepping the log finds a plausible-looking answer while blame silently ignores nothing. The note now calls out the merge as a rewrite too and gives the ancestry check, which actually fails when the entry is wrong.

The add-a-package lint step described the pre-refactor pattern

Step 4 told a new package to give itself an eslint.config.ts carrying the no-restricted-imports/no-restricted-globals Node ban, "using a sibling's own config as a template" — the exact hand-rolled duplication packageLintConfig() was built to remove. Pure doc drift: every package already calls the helper.

Rewritten to name the helper and the isomorphic flag, and to say where package-specific rules belong — the helper's own options, not a second config block. That last part is the non-obvious bit worth writing down: flat config replaces a same-key rule rather than merging it, so a hand-written no-restricted-imports silently switches the isomorphism ban back off while still reporting itself as working. markdown-codec's config already carries a comment saying exactly this, learned the hard way.

I verified every option name cited (additionalRestrictedImportPatterns, additionalIgnores, barrelPolicy, nonNullAssertion) exists on PackageLintOptions, so the fix doesn't introduce fresh drift.

Also checked, not changed

Step 5 (_typecheck:attw) — accurate: twelve packages define the script and each one's own typecheck runs it through turbo. Steps 1-3, 6, 7 unchanged.

The two packages that still mention no-restricted-imports/no-restricted-globals (markdown-codec, documents) are legitimate: both call packageLintConfig, and their extra rules are a markdown-library ban routed through the helper's options and the web UI's RPC import boundary respectively.