Document that package.json aliases may target only direct subfolders of src (#21)

Follow-up to #20, which was merged before this landed.

bot-agents has no `package.json` `imports` aliases (`src/` is flat and everything imports relatively), so no code changes. This records the new rule in the docs:

- `.agents/memory/imports-aliases-barrels.md`: aliases may target only a direct subfolder of `src/` (its `index.ts` or a `#x/*` pattern); nothing outside `src/`, not `src/` itself, not deeper folders; such code imports relatively.
- `.agents/memory/tests-layout-vitest.md`: `tests/` reach the public entry through a relative import, not a `#plugin` alias.
- `.agents/skills/migrate-deno-repo/SKILL.md` and `AGENTS.md`: same rule.

`vp check`, `vp test`, and `damem doctor` pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #21
Reviewed-by: bot <noreply@capsulizers.com>
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>

.agents/memory/package-json-shape.md

@@ -1,46 +1,29 @@
 ---
-description: package.json key order is metadata, scripts, exports, imports, devDependencies, dependencies; standard fields only; no peerDependencies or packageManager
+description: package.json keys follow Oxfmt's standard order (vp check --fix); standard fields only; no peerDependencies or packageManager
 ---
 
-## Key order (2026-10-14)
+## Key order (2026-10-16)
 
-Metadata first, then `scripts`, `exports`, `imports`, `devDependencies`,
-`dependencies`. Oxfmt would re-sort the file, so `vite.config.ts` sets
-`fmt: { sortPackageJson: false }`; keep it, and keep the order by hand.
+Oxfmt's standard `package.json` sorting is accepted: there is no
+`fmt: { sortPackageJson: false }`, and `vp check --fix` sets the order. This
+replaces the earlier hand-written order (metadata, `scripts`, `exports`,
+`imports`, `devDependencies`, `dependencies`).
 
-```jsonc
-{
-  "name": "@cunarist/eslint-plugin-x",
-  "version": "0.1.0",
-  "description": "...",
-  "keywords": ["eslint", "eslint-plugin", "eslintplugin", "oxlint"],
-  "license": "MIT",
-  "repository": { "type": "git", "url": "git+https://github.com/..." },
-  "type": "module",
-  "files": ["dist"],
-  "engines": { "node": ">=22" },
-  "eslint-doc-generator": {/* tool options that can only live here */},
-  "scripts": { "docs": "eslint-doc-generator" },
-  "exports": { ".": "./dist/index.js" },
-  "imports": { "#helpers": "./src/helpers/index.ts" },
-  "devDependencies": { "vite-plus": "^1.1.0" },
-  "dependencies": {},
-}
-```
-
-The `imports` key order can carry meaning: import-check's
+The `imports` key order can carry meaning: the import-structure plugin's
 `enforce-layer-order` reads it as the layer order. Never reorder it casually.
 
 ## Fields
 
-- **Standard fields only.** `engines` has only `node` (never `engines.bun`).
+- **Standard fields only.** App repos have no `engines` field (user decision
+  2026-10-18; images pin Node, [[toolchain-node-vite-plus]]). Published
+  packages keep `engines` with only `node` (never `engines.bun`).
   A tool-owned key (`eslint-doc-generator`) is allowed only because the tool
   reads nothing else and no other config file is allowed.
 - **No `packageManager`.** npm is detected from `package-lock.json`.
 - **No `peerDependencies`, ever** (user preference, 2026-10-14). If something
   is needed at runtime, it goes in `dependencies`.
 - **`dependencies`** = what runs or is type-referenced at runtime by consumers
-  (the lit plugin ships `parse5`, `oxc-parser`, `oxc-resolver`, and
+  (the lit-robust plugin ships `parse5`, `oxc-parser`, `oxc-resolver`, and
   `@eslint/core` for its public types; they stay external, never bundled).
 - **`devDependencies`** = everything else: `vite-plus`, `eslint`,
   `@typescript-eslint/parser`, `eslint-doc-generator`, `esbuild`,
@@ -49,3 +32,9 @@ The `imports` key order can carry meaning: import-check's
 
 Refresh the lockfile with `npm install` (or `npm install
 --package-lock-only` for a version bump) and commit it with the change.
+
+Alias rule: an alias may point anywhere and owns its target (a folder's
+`index.ts` owns the folder and everything below it; any other file owns only
+itself). No two aliases may own the same file, outside an area only the exact
+alias reaches it, and `../` is banned in every file
+([[imports-aliases-barrels]]).