#4121 refactor: extract client workspace package

Summary

Extracts the typed client factory into the private workspace package @agent-device/client (mostly renames; src/agent-device-client.ts → packages/client/src/index.ts keeps its lineage).

• Entry exports exactly .: createAgentDeviceClient and pickScreenshotResultData (used by the screenshot CLI command). No export *, no test-only exports.
• Normalizers, identifiers, lease client and screenshot result move with it. src/client/client-types.ts stays the released SDK type facade.
• Type-only callers import AgentDeviceClient from command-surface and request/config/result types from contracts/client.
• Package-owned tests move beside the code; shared fixtures move to test-kit; root composition tests are renamed for R84.
• Layering, entry pin, process entries, oxlint cap, Fallow key and mutation exclusion follow the paths. The client zone now ranks 5, with daemon-client.
• debug.symbols still imports platform-apple/debug-symbols lazily.

No CLI/SDK/MCP behavior change.

Validation

• pnpm check --head a3745e163c40ba547b4a2d09102a01d1a4675120: passed, exactCommit: true (tooling, fallow, unit).
• CI Coverage failed at 8d0d549130 in android-lifecycle.test.ts (pidof inside the exact gfxinfo window). Cause: the active log follower probes the pid every 500ms through the same scripted ADB. A 700ms framestats delay reproduces it at base c1f1fd02ad and at 8d0d549130, so it predates this PR. The test now stops the follower before the window and still asserts the stop result. With the delay, the fixed test passes.
• provider-integration under coverage: 68 files, 245 tests passed; android-lifecycle re-run after the final edit.
• Eager closure: 236 modules, same as base, 0 platform-*. .d.ts matches base apart from one region comment.
• Not run locally: native and device lanes (CI-authoritative). Pure relocation, so no live device run.

🤖 Generated with Claude Code