Gate JSDoc completeness on every package export

New doc-sync gate verify-export-jsdoc walks every module-level exported
name under packages/*/*/src and requires description prose everywhere,
plus @param per parameter and @returns on non-void annotated returns for
function-like exports, public class methods, properties, and accessors.
The parsing + check helpers move out of gen-cordis-catalog.ts into a
shared scripts/jsdoc.ts so 'documented' means one thing on both gated
surfaces.

Deliberate exemptions (documented in the RFC): heritage-declared class
members (the seam declaration is the doc's one home — the one checker
query in an otherwise pure-AST walk), cordis plugin-protocol slots
(name/inject/reusable/Config/apply, top-level and static), constructors,
overload implementations, declare-module augmentation bodies, and
re-export statements (checked at the defining module).

The 203 under-documented exports the gate found at adoption are filled
in this change, so the gate lands green; generated catalogs/graphs are
regenerated for the shifted line pointers.

RFC: docs/rfc/implemented/process/2026-07-06-export-surface-jsdoc-gate.md

packages/hooks/hook-protocol/src/matcher.ts

@@ -34,6 +34,10 @@ const CLAUDE_LITERAL = /^[A-Za-z0-9_|]+$/
  * pattern exact-matches the query (splitting `|` into alternatives); every other
  * `claude` pattern and ALL `codex` patterns are tested as an unanchored regex.
  * An invalid regex matches nothing (never throws).
+ * @param matcher - the configured pattern; absent/empty/`'*'` are the match-all sentinels.
+ * @param query - the candidate value (a tool name, a session source, …).
+ * @param mode - the dialect deciding literal-vs-regex interpretation of the pattern.
+ * @returns `true` when the pattern selects the query; `false` on a non-match or an invalid regex.
  */
 export function matchesMatcher(matcher: string | undefined, query: string, mode: MatcherMode): boolean {
   if (isMatchAll(matcher)) return true