feat: move challenge packages under challenges/ and discover them by convention

[theycallmeswift]

Packages now live under challenges/ (moved with git mv), and tools/verify.mjs discovers them there at any depth, so grouping folders such as challenges/beginner/<id> work without a change. A package at the repo root, directly in challenges/, or in another top-level directory fails verify with a message naming it. Closes #16.

Decide

• Where should the "outside challenges/" check look? Recommend: the repo root, challenges/ itself, and top-level directories only, because test/fixtures/ legitimately holds manifests deeper in the tree; a stray like beginner/foo/challenge.json at the root is not caught.
• challenges/hello-world/README.md named its old path in the standalone Pi instructions. Recommend: update those two paths, because the standalone flow must keep working; no other package content changed.

Ready gate

Step	Evidence
Tests and lint	npm run verify: ok for challenges/birdsbirdbirds, challenges/hello-world, challenges/vibe-coding-mad-libs, exit 0. npm test: 192 tests, 192 pass, 0 fail. npm run lint: 0 issues in 15 files. CI green on 9c1171d: run 38852537008.	✅
Red run	node tools/verify.mjs --root test/fixtures/roots/outside prints stray/challenge.json is outside challenges/; move its package under challenges/ and exits 1 (covered by the CLI exits 1 naming a package outside challenges/ test). --root test/fixtures/roots/grouped finds challenges/beginner/gamma and exits 0.	✅
Sibling sweep	Searched the repo for the three package names followed by / outside challenges/, and for "top-level"; every remaining hit is about the test directory or the root-level check. Tests, README, AGENTS.md, docs/style/testing.md, .markdownlint-cli2.jsonc and fixtures were updated.	✅
Docs and specs	README (index links, local-run command, checks), AGENTS.md (layout, symlink rule, project structure), docs/style/testing.md; docs/cloud-agents.md names no package paths.	✅
Standalone run	No package contents changed beyond the move and the two path fixes in the hello-world README, so the standalone flow is unchanged; the Pi playthrough is #8's.	✅
Editorial pass	Reread against docs/style/; nothing cut. Every function has a doc comment, and the walk stays inside challenges/ and never follows unsafe symlinks. Independent review: four blocking findings (a challenges symlink escaping the repo, a missing cross-group duplicate-id test, two overstated doc sentences), all fixed.	✅
Skipped tests	None.	✅
Secrets, permissions	Not touched.	✅

---

Generated by Claude Code