Fix stale blame-ignore hash and add-a-package lint step

.git-blame-ignore-revs

@@ -8,7 +8,7 @@
 #
 # Only whole-tree reformats belong here -- a commit that changed behaviour must stay blameable even if it also reformatted.
 #
-# A SHA recorded here goes stale if the branch is later rebased, since the rebase rewrites it. Record it after the reformat commit reaches its final position in history, and re-check it after any rebase: `git log --format='%H %s' | grep '^.* style: format'` against the entries below.
+# A SHA recorded here goes stale whenever the commit it names is rewritten, which includes rebase-merging the pull request that introduced it onto main -- not just a local rebase before merging. Record the SHA the commit has once it is on main, and verify with `git merge-base --is-ancestor <sha> HEAD`. Matching by subject line is not a check: a stale entry still has a real commit somewhere in the reflog to find, so grepping the log finds a plausible hash while blame silently ignores nothing.
 
 # style: format the workspace with prettier
-e8febdfde25d9d1386e8f6ab489291ac3b59cd45
+c12e74028aaf5f62cad1c64a414d091c7ecc83db

CONTRIBUTING.md

@@ -21,7 +21,7 @@ Bringing a new package into `packages/*` — whether newly written or absorbed f
 1. **Create `packages/<name>/`** with its own `package.json`, matching the sibling scripts convention: `build`/`_build`, `lint`/`_lint`, `typecheck`/`_typecheck` (plus `_typecheck:node` if the package needs a second `tsconfig.node.json` pass), `test`/`_test`, and the rest of `turbo.json`'s task names. `pnpm-workspace.yaml`'s `packages: ["packages/*"]` picks it up automatically — no workspace-file edit needed just for registration.
 2. **Declare sibling dependencies as ordinary semver ranges**, never `workspace:*` — `linkWorkspacePackages: true` links the workspace copy whenever the range is satisfied, falling back to the registry otherwise (see the root README's [Dependency ranges between packages](README.md#dependency-ranges-between-packages)).
 3. **Add the package's bare name to `pnpm-workspace.yaml`'s `minimumReleaseAgeExclude` list.** Without it, `pnpm install --frozen-lockfile` (the mode CI runs) can reject the package's own same-day release the moment a sibling bumps to depend on it.
-4. **If the package is Worker-isomorphic** (every foundation and format-codec package is — see the root README's [Conventions](README.md#conventions)), give it its own `eslint.config.ts` with the `no-restricted-imports`/`no-restricted-globals` Node-ban rule and a `test:workers` suite proving it at runtime, using a sibling's own config as a template.
+4. **Give it an `eslint.config.ts` that calls `packageLintConfig`** from the root's `eslint.shared.ts`, passing `tsconfigRootDir: import.meta.dirname` and — if the package is Worker-isomorphic, as every foundation and format-codec package is (see the root README's [Conventions](README.md#conventions)) — `isomorphic: true`, plus a `test:workers` suite proving it at runtime. Don't copy a sibling's config and don't restate the Node-builtin ban: the shared helper derives that ban from `node:module`'s own `builtinModules`, so a package opts in with one flag rather than a hand-maintained module list that silently rots as Node adds builtins. Anything genuinely specific to the package goes through the helper's own options (`additionalRestrictedImportPatterns`, `additionalIgnores`, `barrelPolicy`, `nonNullAssertion`, …), **not** a second config block: flat config replaces a same-key rule rather than merging it, so a second `no-restricted-imports` of your own would silently switch the isomorphism ban back off while still reporting your rule as working.
 5. **If the package publishes and exposes types, add `"_typecheck:attw": "attw --pack"`** to its scripts and include `_typecheck:attw` in its own `typecheck` script's turbo run list. Turbo silently skips a package missing the script — no error, no warning — so a package that forgets this step gets no export-resolution check at all, forever, until someone happens to notice.
 6. **Configure the package's npm trusted publisher to point at this repository's own `.github/workflows/ci.yml`**, not wherever it published from before. This is the step with no local signal that anything is wrong: a package absorbed from a former standalone repo keeps whichever trusted-publisher configuration it already had on npmjs.com, and OIDC publishing from _this_ workflow fails outright (`ENONPMTOKEN No npm token specified`) until it's updated — and because packages release in one topological pass that aborts on the first failure, a misconfigured package sitting early in that order blocks every other package's release too, not just its own. Do this **before** the package's first release attempt here, not after.
 7. **List the package in the root README's package table** (and its Worker-isomorphic list in Conventions, if applicable), and run `pnpm install` at the root so the lockfile picks it up.