[v0.4.4] tighten-barrel: narrow public API in core/index.js

[lora-sys]

Follow-up from v0.4.1 review (docs/evidence/v0.4.1/review-report.md).

packages/core/src/index.js currently re-exports everything from vault.mjs including internals. Should narrow to a public API.

Goal

Define a clean public surface: Vault class, parse, stringify, slugify, withFileLock, withLockedMutation, the LLM providers. Mark other helpers as internal (still accessible via deep import but not in barrel).

Scope

• packages/core/src/index.js — narrow the re-exports
• Add JSDoc comments marking which exports are public vs internal
• Update internal consumers if they re-export (they're all in core currently, no harm)

Non-Goal

• Don't break existing API in v0.4.x
• Don't refactor every file

Acceptance Criteria

• index.js exports only the public API
• Internal helpers not in barrel but still importable via deep path
• All v0.4.1 tests still pass