feat(react): add the Checkbox primitive

[ivanbanov]

Summary

Adds the Checkbox primitive as two packages:

• @dunky.dev/checkbox — the framework-free core: a tri-state state machine (checked / unchecked / indeterminate) following the WAI-ARIA APG Checkbox pattern, built on @dunky.dev/state-machine.
• @dunky.dev/react-checkbox — the thin React binding exposing the compound Checkbox component.

checked / defaultChecked accept boolean | 'indeterminate', so a bulk-selection parent is driven by a single controlled value. Value changes report through onCheckedChange, but re-syncing the controlled checked prop is never echoed back.

Anatomy

<Checkbox>          - root; owns the checked state, renders nothing of its own
  |_ <Control>      - the interactive element carrying the checkbox role
  |_ <Indicator>    - the visual mark; exists only while checked or indeterminate
  |_ <Label>        - names the control; pressing it toggles too

Behavior

• Toggle: press (pointer or Space) toggles; indeterminate always resolves to checked — the user can never reach indeterminate by interaction, only the consumer sets it.
• Keyboard: Space toggles; Enter is suppressed by the core so a button-backed control does not activate on Enter, per APG.
• ARIA: the control carries role="checkbox" with aria-checked (true / false / mixed), and is named by the Label via aria-labelledby minted from the root id.
• Disabled: conveyed as aria-disabled (control stays focusable and discoverable); the machine blocks user intent while programmatic and controlled updates still apply. Every part carries data-state and data-disabled styling hooks.
• Label: pressing the label toggles, matching the native label affordance, wired through the machine (not native <label for>) so the disabled guard holds everywhere.

Test plan

• pnpm test:ci — 114 tests, 9 files, all passing
• pnpm typecheck
• pnpm lint
• pnpm format:check
• pnpm build — publint clean for both new packages

🤖 Generated with Claude Code