extract(eslint-plugin-operant): unfork, publish as single canonical package

## Problem
Both Portico and Ledger ship a `tools/eslint-plugin-operant/` and the two have diverged:
- Ledger's version added `no-raw-prisma-in-routes` (documented, working) and removed the docs for `audit-event-points-sequence`.
- Portico's version has the reverse.
- Neither is a superset. Diff shows real code drift.

## Scope
1. Diff the two `tools/eslint-plugin-operant/` trees; merge both rule sets into Ledger's canonical copy.
2. Bump version, publish as `@operant/eslint-plugin` from `packages/eslint-plugin/` in operant-studio (move out of `tools/`, into `packages/` so it can be depended on cleanly).
3. Update Portico's ESLint config to depend on the published package.
4. Delete Portico's local `tools/eslint-plugin-operant/`.
5. Piper DX / Roster boilerplate should reference the same package.

## Depends
- Nothing.

## Blocks
- Any Piper DX scaffolding.

## Verification
- Portico ESLint passes with only the shared package.
- Both rules (`no-raw-prisma-in-routes`, `audit-event-points-sequence`) fire in test files.
- Publish output visible in operant-studio artifact/registry.