ci: add TypeScript quality profile

[TheDanniCraft]

📝 Description

Adds an opt-in TypeScript quality profile to the organization baseline. The
profile is independent of Supabase and applies to Bun-based TypeScript or
JavaScript repositories that explicitly enroll in it.

The central profile owns Biome, TypeScript, Vitest, Fallow, editor settings,
the Code Quality workflow, and its required ruleset. A new Repository Profile
Bootstrap workflow first creates the package-and-lockfile pull request for a
chosen repository. It adds only missing profile values, stops on a conflicting
repository-owned value, and regenerates bun.lock with lifecycle scripts
disabled. Once that PR is merged, normal baseline synchronization supplies the
remaining managed files and required check.

🧩 Type of Change

• 🤖 CI/CD or automation
• 🧹 Maintenance

🗺️ Areas

• Infrastructure
• Reliability

🧪 Testing and Validation

node --test .github/scripts/*.test.mjs
node --check .github/scripts/repository-baseline.mjs
node --check .github/scripts/profile-bootstrap.mjs
JSON schema parse checks
git diff --check

🔐 Security, Compatibility, and Operations

The profile is opt-in. The bootstrap workflow uses the existing organization
GitHub App token only for the selected Payload Bay repository, refuses package
contract conflicts, and runs bun install --lockfile-only --ignore-scripts.
It does not execute repository lifecycle scripts. Fallow review comments use
the normal pull-request token and remain bounded to ten comments.

📋 Checklist

• I have read and understood the Contribution Guidelines
• This pull request addresses one focused change
• My pull-request title follows Conventional Commits
• My commit messages follow Conventional Commits
• I have performed a self-review of the complete diff
• I understand and can explain every submitted change
• I have removed debug output, unrelated changes, and generated noise
• I have added or updated appropriate tests, or explained why none are needed
• I have updated relevant documentation, or explained why none is needed
• My changes introduce no unexpected warnings or errors
• I have considered security, compatibility, deployment, and rollback effects
• I have not included credentials, secrets, private payloads, or personal data
• Any required dependent changes are linked and clearly identified

🤖 AI Usage

• 🤖 This pull request includes AI-assisted work

🛠️ How AI Was Used

• 🔍 Code review or analysis
• 🧠 Ideation, research, or planning
• ✍️ Drafting code
• ♻️ Modifying or refactoring code
• 📝 Drafting or editing documentation or other text
• 🧪 Designing tests or validation steps
• 🐛 Debugging or investigating a failure

🔎 AI Tools and Human Review

Codex assisted with the profile design and implementation. The resulting
configuration, synchronization logic, workflow, and tests were inspected
locally. The listed validation commands were run against the final worktree.

✅ AI Responsibility

• I reviewed all AI-assisted content line by line
• I verified factual, technical, security, and licensing claims
• I tested the resulting behavior rather than trusting generated assertions
• I accept full responsibility for the submitted work
• I confirm this contribution is not automated spam or generic AI slop

💬 Additional Context

payloadbay/payloadbay is registered from the start, but its profile remains
inactive until the generated bootstrap PR has merged. Until then, baseline sync
reports the profile as waiting and does not apply its managed files or required
check. After merge, run baseline synchronization for payloadbay; it applies
the managed quality files before it adds the required status check.