ci: require warning-free quality gates

[oratis]

Summary

• remove the final repository lint warning
• make root lint fail on any future warning
• mark the arbitrated Codex-alignment implementation complete across stacked PRs docs: establish Codex alignment roadmap #180-ci: require warning-free quality gates #210
• keep real tag publication, Apple credentials, notarization, and updater signing explicitly outside automatic code mutation

Validation

• pnpm lint: zero warnings
• pnpm typecheck
• pnpm test: 1028 passed, 12 skipped
• pnpm format:check
• pnpm docs:check
• targeted vision suite: 18 passed

Stacked on #209.

[oratis]

Review: approved ✅ — stack capstone

+10/−5. Removes the last repository lint warning and sets root lint to fail on any future one.

On --max-warnings=0: worth stating the tradeoff plainly. It's the right setting — warnings that nobody must fix accumulate until the whole signal is ignored, and this repo was already carrying "3 pre-existing warnings" as a standing footnote in every PR body in this stack. Getting to zero and locking it is how that stops. The cost is that dependency bumps introducing a new lint rule now fail CI rather than warn, so some future Dependabot PRs will need a code fix rather than a rubber stamp. Given #208's gates already demand real artifacts, that's consistent.

On the honesty of the final item: keeping real tag publication, Apple credentials, notarization, and updater signing explicitly outside automatic code mutation is the correct boundary. Those are operator actions with irreversible consequences, and a stack that automated them would be a stack that could publish on its own. Good that it stops short.

---

Closing note on #180–#210 as a whole. Reviewed and merged all 31 in dependency order. The through-line is consistent and the sequencing is disciplined: the gate bypass in #181 was the actual severe bug (an omitted mode skipped mode, permissions, and hooks for every tool call), and everything after it removes the conditions that let a second, differently-assembled runtime exist — desktop, VS Code, and LSP are now protocol clients with no provider, credentials, agent loop, or RuntimeHost, and #208's thin-client scan enforces that going forward.

Verified locally at the stack tip before merging: typecheck, lint --max-warnings=0, format:check, docs:check, and 1033 tests across 8 packages all green.

Two things I flagged along the way that are worth carrying forward rather than losing in the merge: the ~6.7 MB → ~115 MB desktop size increase from the Node sidecar (#187) belongs in user-facing release notes, and the plugin capability API is not an OS boundary (#200/#209) — third-party plugins remain trusted code until an OS sandbox lands.