Gate JSDoc completeness on every package export

New doc-sync gate verify-export-jsdoc walks every module-level exported
name under packages/*/*/src and requires description prose everywhere,
plus @param per parameter and @returns on non-void annotated returns for
function-like exports, public class methods, properties, and accessors.
The parsing + check helpers move out of gen-cordis-catalog.ts into a
shared scripts/jsdoc.ts so 'documented' means one thing on both gated
surfaces.

Deliberate exemptions (documented in the RFC): heritage-declared class
members (the seam declaration is the doc's one home — the one checker
query in an otherwise pure-AST walk), cordis plugin-protocol slots
(name/inject/reusable/Config/apply, top-level and static), constructors,
overload implementations, declare-module augmentation bodies, and
re-export statements (checked at the defining module).

The 203 under-documented exports the gate found at adoption are filled
in this change, so the gate lands green; generated catalogs/graphs are
regenerated for the shifted line pointers.

RFC: docs/rfc/implemented/process/2026-07-06-export-surface-jsdoc-gate.md

packages/hooks/hook-protocol/src/events.ts

@@ -66,6 +66,9 @@ export const DEFAULT_STDERR_SUMMARY_MAX_CHARS = 500
  * `undefined` when empty, cut at `maxChars` with an ellipsis when over. The
  * bound is a parameter — like `runHook`'s `defaultTimeoutMs`, each bridge owns
  * the config default and passes it in.
+ * @param stderr - the hook's raw captured stderr.
+ * @param maxChars - the character cap for the summary (the bridge's config value).
+ * @returns the trimmed, capped summary, or `undefined` when stderr is blank.
  */
 export function summarizeStderr(stderr: string, maxChars: number): string | undefined {
   const t = stderr.trim()
@@ -73,7 +76,11 @@ export function summarizeStderr(stderr: string, maxChars: number): string | unde
   return t.length > maxChars ? t.slice(0, maxChars) + '…' : t
 }
 
-/** Append a `hook/invoked` provenance event to `session`. */
+/**
+ * Append a `hook/invoked` provenance event to `session`.
+ * @param session - the session whose open turn records the event.
+ * @param invocation - the invocation identity; an absent `matcher` is omitted from the payload.
+ */
 export function appendHookInvoked(session: Session, invocation: HookInvocation): void {
   session.append('hook/invoked', {
     turn: invocation.turn,
@@ -91,6 +98,8 @@ export function appendHookInvoked(session: Session, invocation: HookInvocation):
  * else `'pass'`; `stderrSummary` is the trimmed stderr truncated to
  * `record.stderrSummaryMaxChars` characters (omitted when empty); `exitCode`
  * is omitted when the hook never ran.
+ * @param session - the session whose open turn records the event.
+ * @param record - the outcome to record: the decoded output plus the summary cap and duration.
  */
 export function appendHookResult(session: Session, record: HookResultRecord): void {
   const { output } = record