fix(agents): parse JSONC and constrain package exemptions

docs/development/agent-workflow.md

@@ -53,12 +53,13 @@ as Markdown links, including decoded attributes and fragment validation.
 Image references check file existence without interpreting image fragments as
 Markdown headings; document links keep anchor checks even when sharing a target.
 Inline guidance imports are rejected after punctuation as well as whitespace.
-Scopes declared by package dependencies or TypeScript path aliases are recognized
-as package/alias mentions rather than additional file imports.
+Declared scoped dependencies, scope wildcards and matching TypeScript path aliases
+are recognized as package/alias mentions. Traversal and document-file imports are
+rejected before those exemptions. TypeScript configuration is parsed as JSONC.
 The import scan includes visible HTML text and excludes code and non-rendered containers.
 Image source sets use `parse-srcset` to check each candidate URL. Root-relative
 literals never suppress source-relative definition checks.
-The Nx test hash includes `marked`, `parse5`, `github-slugger` and `parse-srcset`
+The Nx test hash includes `marked`, `parse5`, `github-slugger`, `parse-srcset` and `typescript`
 so dependency changes invalidate parser coverage.
 It cannot prove semantic equivalence; review changed contracts as well.