fix(scripts): resolve repo root via shared lib helper, eliminate scripts/utils

[John-David Dalton (jdalton)]

What this does

Repo scripts now find the repository root with the shared
@socketsecurity/lib-stable helper instead of a hand-rolled path helper,
and the non-segmented scripts/utils/ directory is removed.

This supersedes #668 and does it the way the maintainer asked:

1. Root resolution uses the shared lib helper, not a per-repo getRootPath.
2. No non-segmented scripts: everything lives under scripts/fleet/ or
   scripts/repo/.

The bug it fixes

scripts/utils/path-helpers.mts computed the repo root as
dirname(script)/... That only works for a script sitting directly in
scripts/. Once these scripts moved into scripts/repo/, the helper
returned scripts/ instead of the repo root, so the generators looked
for openapi.json (and the other root files) in the wrong directory.

How root resolution works now

Each of the 7 call sites walks up from its own location to the nearest
package.json and takes that directory:

import { findUpSync } from '@socketsecurity/lib-stable/fs/find'

const rootPackageJsonPath = findUpSync('package.json', {
  cwd: path.dirname(fileURLToPath(import.meta.url)),
})
if (!rootPackageJsonPath) {
  throw new Error('Unable to locate repository root (package.json not found).')
}
const rootPath = path.dirname(rootPackageJsonPath)

findUpSync is already a public export of @socketsecurity/lib-stable
("walk up parent directories to locate a file"). No socket-lib change and
no new export were needed, so there is no publish step.

Eliminating scripts/utils/

scripts/utils/ was a third top-level script namespace alongside
scripts/fleet/ and scripts/repo/. It is now gone:

• path-helpers.mts deleted — its job is now the lib helper.
• run-command.mts -> scripts/repo/run-command.mts (only imported by
  scripts/repo/build.mts and scripts/repo/generate-sdk.mts).
• changed-test-mapper.mts -> scripts/repo/changed-test-mapper.mts
  (repo-scoped: it maps this repo's src/ files to its test/ files).
• Every importer updated.

Nothing under scripts/fleet/ imported either moved file (the one
lookalike, scripts/fleet/ai-lint-fix/util/run-command.mts, is a
separate file), so scripts/repo/ is the correct home.

Verification

All run with Node 24.

Check	Result
pnpm run type (tsgo --noEmit)	pass
pnpm run lint	pass
root-scripts-are-segregated	pass
script-paths-resolve	pass
tests-are-mirror-named	pass
generated-globs-are-consistent	pass
generated-outputs-are-untracked	pass
docs:api:check (gen-api-docs + gen-api-docs-lib)	pass, docs/api.md up to date
check:quota-sync (validate-quota-sync)	pass
generate-types / generate-strict-types	resolve openapi.json and write to the correct repo-root paths
test suite	925/931 pass

About the 6 pre-existing test failures

They are environmental, not from this change (which only touches
scripts/repo/*):

• test/repo/unit/utils.test.mts (3): assert the resolved path contains
  the literal string socket-sdk-js; the CI/worktree checkout dir is not
  named that. Tests src/utils.mts, untouched here.
• test/repo/unit/bundle-validation.test.mts (3): validate dist/index.js
  / dist/index.browser.js, which require a build that was not run.

The generated types/api.d.ts and src/types-strict.mts are left as-is:
running generate-types standalone emits unformatted output (the
committed file is the oxfmt-formatted result of the full generate-sdk
pipeline), so its diff is a formatting artifact, not a content change.