[Stage 1.6] Enforce workspace boundaries and finalize the v2 CI gates

[draedful]

Parent: #318

Goal

Turn the workspace and package boundaries established in Stage 1 into enforceable repository rules and make them the required v2 CI contract.

Scope

• Add ESLint restrictions for cross-package source imports and imports from private implementation packages by applications.
• Add a dependency-graph check, such as dependency-cruiser, for forbidden dependency directions and cycles.
• Require workspace dependencies to use the agreed pnpm workspace protocol.
• Make CI install with a frozen pnpm lockfile.
• Run linting, type checking, unit tests, production builds, package metadata checks, and tarball consumer checks.
• Build Storybook and run Playwright E2E against package entry points.
• Ensure CI and release jobs do not bypass the packages/graph artifact through source aliases.
• Document the required local verification commands for contributors.

Acceptance criteria

• A cross-package source import fails an automated check.
• A forbidden dependency direction or package cycle fails CI.
• CI validates the packed @gravity-ui/graph artifact in isolated consumers.
• Storybook and E2E run against public package entry points.
• All required checks run from a clean checkout with a frozen lockfile.
• The documented local verification command reproduces the required CI checks.
• All Stage 1 exit criteria in [Stage 1] Establish the v2 workspace and package baseline #318 are satisfied or explicitly linked to follow-up work.