fix: add .js extension to import-lexer import in repo-patterns

Published 0.8.1 and 0.8.2 shipped a broken ESM import in
dist/repo-patterns.js (`from "./import-lexer"` without .js).
Node strict ESM resolution rejects the extensionless path,
crashing any consumer that imports repo-patterns at runtime.
Webpack/Turbopack tolerated it on the host, masking the bug,
but it broke the API server in Docker.

Add .js to the source so future builds (and any future drift
in fix-esm-imports.mjs) stay correct.

Bumps governance-sdk to 0.8.3.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: scotty595

packages/governance/package.json

@@ -1,6 +1,6 @@
 {
   "name": "governance-sdk",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "AI Agent Governance for TypeScript — policy enforcement, scoring, compliance, and audit for AI agents",
   "type": "module",
   "main": "./dist/index.js",

packages/governance/src/repo-patterns.ts

@@ -5,7 +5,7 @@
  * Feed it file contents, get capability detection results.
  */
 
-import { extractToolImports, parseImports, toolNamesFromImport } from "./import-lexer";
+import { extractToolImports, parseImports, toolNamesFromImport } from "./import-lexer.js";
 import type { ScannerPlugin, FileResolver } from "./scanner-plugins/types.js";
 
 /** Detection result for a single capability */