Move challenge packages under challenges/ and discover them by convention #16

Goal

Challenge packages live under challenges/, so the repo root stays small as the catalog grows. Stations need no change: the event config already takes nested paths such as challenges/hello-world (boothstrap's docs/event-config.md). No manifest file; the layout is the convention.

Scope

• git mv the three packages to challenges/hello-world, challenges/vibe-coding-mad-libs, challenges/birdsbirdbirds, keeping history.
• tools/verify.mjs: discover packages under challenges/ only, at any depth (a directory holding challenge.json; don't descend into a package, node_modules, or dot-directories), so grouping folders such as challenges/beginner/<id> work later without a change. Keep the duplicate-id check. Extend the unsafe-symlink check to every directory walked. A challenge.json found outside challenges/ fails verification with a message naming it, so a package can't be left at the root by mistake.
• test/fixtures/roots/*: move fixture packages under each root's challenges/; add cases for a nested grouping folder and for a package outside challenges/. test/verify.test.mjs covers all of it.
• test/<id>.test.mjs: update the package paths they import or resolve.
• .markdownlint-cli2.jsonc: the */intro.md ignore becomes challenges/**/intro.md.
• Docs: README.md index links and the local-testing commands; AGENTS.md project structure (packages under challenges/, event configs list challenges/<id>); docs/style/testing.md and docs/cloud-agents.md where they name the layout.

Owns

Everything in the repo; the move touches every package path.

Working rules

• No manifest, no new config file.
• Packages' own contents don't change beyond the move.
• Open the PR after the Mad Libs PR (feat(mad-libs): open the preview as soon as the app is built #15) is merged, which it now is.

Acceptance

• ls at the repo root shows no package directories; all three are under challenges/.
• npm run verify finds all three and passes; a fixture with a package at the root fails with a message naming it; a fixture with challenges/<group>/<id> is found.
• npm test and npm run lint pass.
• README links resolve and the local-testing commands use the new paths.