Document that package.json aliases may target only direct subfolders of src (#21)

Follow-up to #20, which was merged before this landed.

bot-agents has no `package.json` `imports` aliases (`src/` is flat and everything imports relatively), so no code changes. This records the new rule in the docs:

- `.agents/memory/imports-aliases-barrels.md`: aliases may target only a direct subfolder of `src/` (its `index.ts` or a `#x/*` pattern); nothing outside `src/`, not `src/` itself, not deeper folders; such code imports relatively.
- `.agents/memory/tests-layout-vitest.md`: `tests/` reach the public entry through a relative import, not a `#plugin` alias.
- `.agents/skills/migrate-deno-repo/SKILL.md` and `AGENTS.md`: same rule.

`vp check`, `vp test`, and `damem doctor` pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #21
Reviewed-by: bot <noreply@capsulizers.com>
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>

src/runtime.ts

@@ -39,24 +39,6 @@ async function writePrivate(path: string, value: string, uid: number, gid: numbe
   await chown(path, uid, gid);
 }
 
-async function prepareProfile(
-  runtimeDir: string,
-  profile: BotProfile,
-  index: number,
-): Promise<RuntimeProfile> {
-  const uid = FIRST_PROFILE_UID + index;
-  const home = join(runtimeDir, `profile-${index}`);
-  await mkdir(home, { mode: 0o700 });
-  await chmod(home, 0o700);
-  await chown(home, uid, uid);
-  const tokenFile =
-    profile.token === undefined || profile.token === "" ? null : join(home, "token");
-  if (tokenFile !== null && profile.token !== undefined) {
-    await writePrivate(tokenFile, profile.token, uid, uid);
-  }
-  return { index, type: profile.type, model: profile.model, uid, gid: uid, home, tokenFile };
-}
-
 export async function prepareRuntime(
   actionPath: string,
   runtimeRoot: string,
@@ -74,10 +56,29 @@ export async function prepareRuntime(
 
     // One profile at a time, in order, as each claims the next UID.
     const profiles = await credentials.profiles.reduce<Promise<RuntimeProfile[]>>(
-      async (previous, profile, index) => [
-        ...(await previous),
-        await prepareProfile(runtimeDir, profile, index),
-      ],
+      async (previous, profile, index) => {
+        const prepared = await previous;
+        const uid = FIRST_PROFILE_UID + index;
+        const home = join(runtimeDir, `profile-${index}`);
+        await mkdir(home, { mode: 0o700 });
+        await chmod(home, 0o700);
+        await chown(home, uid, uid);
+        const tokenFile =
+          profile.token === undefined || profile.token === "" ? null : join(home, "token");
+        if (tokenFile !== null && profile.token !== undefined) {
+          await writePrivate(tokenFile, profile.token, uid, uid);
+        }
+        prepared.push({
+          index,
+          type: profile.type,
+          model: profile.model,
+          uid,
+          gid: uid,
+          home,
+          tokenFile,
+        });
+        return prepared;
+      },
       Promise.resolve([]),
     );
 
@@ -100,11 +101,11 @@ export async function prepareRuntime(
 function isRuntimeManifest(value: unknown): value is RuntimeManifest {
   return (
     isMapping(value) &&
-    typeof value.runtimeDir === "string" &&
-    typeof value.manifestPath === "string" &&
-    typeof value.reviewerFile === "string" &&
-    typeof value.outcomeFile === "string" &&
-    Array.isArray(value.profiles)
+    typeof value["runtimeDir"] === "string" &&
+    typeof value["manifestPath"] === "string" &&
+    typeof value["reviewerFile"] === "string" &&
+    typeof value["outcomeFile"] === "string" &&
+    Array.isArray(value["profiles"])
   );
 }