Consolidate the crates.io surface to i Booting Astrid daemon... and

[joshuajbouw]

Problem

The workspace currently publishes or exposes many implementation crates as if each were an independently supported public product surface. In practice, external users should need only:

• astrid — the runtime and CLI distribution
• astrid-types — the stable shared wire and data types intended for Rust consumers

Publishing internal packages creates accidental API commitments. Public items in runtime-internal crates are treated as downstream contracts by semver tooling even when they exist only to connect workspace components. PR #1457 exposed the cost directly: an internal audit event addition became a reported major-version break because astrid-capsule::HostAuditEvent is publicly reachable and exhaustive.

This is not solved by setting publish = false alone: crates.io packages cannot depend on unpublished path-only siblings. The package graph must first be reshaped so the two intended artifacts can be built and published without depending on separately published implementation crates.

Desired outcome

Make astrid and astrid-types the only crates.io packages produced by this repository. Treat every other workspace crate as an internal implementation boundary rather than a promised external API.

Design work

• Inventory the current crates.io package graph and known external dependents.
• Confirm astrid-types is the complete intended Rust contract surface; move genuinely shared public types into it deliberately.
• Decide how astrid absorbs internal packages: package/module consolidation, private workspace implementation, or another crates.io-compatible packaging mechanism.
• Define migration and deprecation handling for already-published internal crates.
• Restrict public-API and semver CI to the two promised packages after the graph is migrated.
• Document the supported dependency story for capsule authors, SDKs, distributions, and embedders.
• Keep WIT contracts and language SDK publication independent; this issue concerns the Rust crates.io surface.

Acceptance criteria

• cargo publish --dry-run -p astrid succeeds without requiring any separately published Astrid implementation crate other than astrid-types.
• cargo publish --dry-run -p astrid-types succeeds independently.
• All other workspace packages are marked non-publishable or cease to exist as packages.
• Public API and semver checks enforce only astrid and astrid-types.
• Existing published internal crates have an explicit deprecation/migration policy.
• Release automation publishes exactly the two intended crates.
• Documentation states which Rust surfaces are stable and supported.

Non-goals

• Do not perform this consolidation inside an unrelated feature or CI-fix PR.
• Do not collapse WIT contracts, guest SDKs, or distribution packaging into the Rust types crate.
• Do not preserve accidental internal APIs solely because they were historically public; handle any real downstream users through an explicit migration decision.