feat: bootstrap essentials-sync and first synced package

[mattnorris]

Summary

• Adds tools/typescript/essentials-sync/ — an agent that extracts a generic, jargon-free ess-* package out of a team-specific tool in a private repo, refactors the original tool into a thin wrapper that supplies the company defaults, and then syncs the extracted package here. Deterministic scanners (TruffleHog, secretlint, jargon, PII) plus an adversarial LLM reviewer on a different model family gate each phase.
• Adds packages/python/ess-service-now-incident/ — the first package produced by the new flow. Fetches ServiceNow incident records via an authenticated browser session (ess-browser). Exposes a build_cli(default_instance=...) factory so per-tenant wrappers can bake in their hostname without forking the library.
• Adds the new package to the uv workspace.

Background

This is the open-source half of an "extract-then-sync" pattern: a single command in essentials-sync produces three artifacts — honeycomb/packages/python/ess-<name>/ (the new generic core), honeycomb/tools/python/<name>/ (rewritten as a thin wrapper), and essentials/packages/python/ess-<name>/ (the sync target, this PR). Mirrors the langsmith-hosting / sales-ai-langsmith-hosting split that already exists in honeycomb.

Test plan

• npm run build passes in tools/typescript/essentials-sync/
• npm test passes (21/21 Vitest tests: jargon scanner, PII scanner, extract-plan name/path derivation)
• End-to-end run produced this PR's contents in ~17 minutes with zero scan-and-revise iterations
• uv sync --all-packages on the consuming private repo resolves cleanly with the new workspace member
• pytest packages/python/ess-service-now-incident/ — 47/47 tests pass (9 CLI + 25 client + 13 get_incident)
• Wrapper CLI smoke test: invoked service-now-incident <real-incident-number> end-to-end (SSO refresh + browser session reuse + description parse all worked)
• rg -i 'cisco|webex|myid|cec|sjc' against the new package returns zero matches

Notes for reviewers

• The synced package depends on ess-browser (already in this repo) for the authenticated Chromium session.
• essentials-sync is implemented in TypeScript because it's a thin CLI around @cursor/sdk. It pins its own Node + Python versions via .nvmrc and .python-version to dodge a sqlite/node-gyp/distutils issue with Python 3.12 — documented in its README.
• The standalone CLI for the new package has no baked-in --instance default; callers must pass --instance, set SERVICENOW_INSTANCE, or use a full URL. Per-tenant wrappers in private repos supply the default.

Made with Cursor