build(release): make the release set publishable under the private scope

Every package under packages/, apps/, and vendor/ drops "private": true and
declares publishConfig.access "restricted": the repository now states which
packages it publishes instead of deciding it at publish time. Each one also
declares its repository and directory, which is how a consumer of a private
package reaches its source.

The Landlock packages move to restricted with them. They have never been
published, so nothing anonymous depends on them today, and the whole
@deepseek-ai scope stays private.

The workspace constraint that required every package to be private now applies
to non-members only, and asserts the publishable trio on each release member.

packages/subagent/subagent-acp/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-subagent-acp",
   "description": "Out-of-process ACP subagent backend: drives a child agent in a spawned subprocess over the Agent Client Protocol",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/subagent-acp"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/subagent-claude-code/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-subagent-claude-code",
   "description": "One-shot Claude Code subagent provider over the official Agent SDK",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/subagent-claude-code"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/subagent-codex/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-subagent-codex",
   "description": "One-shot Codex subagent provider over the official app-server protocol",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/subagent-codex"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/subagent-dsh-sdk/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-subagent-dsh-sdk",
   "description": "Out-of-process SDK subagent backend: drives a child DeepSeek Harness runtime subprocess over stdio JSON-RPC through the TypeScript SDK client",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/subagent-dsh-sdk"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/subagent-fork/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-subagent-fork",
   "description": "In-process fork subagent backend: runs a child agent seeded with a prefix of the parent's log",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/subagent-fork"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/subagent-inprocess/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-subagent-inprocess",
   "description": "Shared in-process subagent run driver: drives a child agent on ctx.agents (used by the spawn and fork backends)",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/subagent-inprocess"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/subagent-spawn/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-subagent-spawn",
   "description": "In-process spawn subagent backend: runs a fresh child agent on ctx.agents",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/subagent-spawn"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/subagent/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-subagent",
   "description": "Abstract subagent seam (ctx.subagents): named-provider registry for delegating to child agents",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/subagent"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/tool-subagent-control/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-tool-subagent-control",
   "description": "Globally named send_message, interrupt_agent, and list_agents tools over ctx.subagents continuations",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/tool-subagent-control"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/tool-subagent-report/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-tool-subagent-report",
   "description": "Child-scoped report tool over ctx.subagents continuations",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/tool-subagent-report"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/subagent/tool-subagent/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-tool-subagent",
   "description": "Model-facing subagent delegation tool over the ctx.subagents seam",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/subagent/tool-subagent"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",