feat(quality): add standalone code quality checks

[rochecompaan]

Summary

• add standalone checks for static analysis, strict typing, production coverage, CRAP, property testing, architecture, and mutation testing
• add focused configuration and an initial fast-check property suite
• document the manual baseline and keep CI unchanged while the results are studied
• update npm lockfiles and the Nix dependency hash for the new development tools

Initial baseline

• production line coverage: 91.76%
• production branch coverage: 85.95–85.96%
• production function coverage: 94.80%
• CRAP: 1,615 functions checked, 12 above 30
• strict typing: 214 errors across 62 files
• architecture: one unresolved typebox dependency
• property tests: 3 passed
• mutation pilot: 38 killed, 19 survived, 66.67% score

The mutation check uses Stryker's command runner. It cannot distinguish uncovered mutants from mutants that weak assertions miss.

Verification

• npm test — 1,306 passed
• npm run lint
• npm run build
• npm run check:static
• npm run check:property — 3 passed
• npm run check:crap
• npm run check:mutation — 66.67% report
• nix flake check --accept-flake-config --print-build-logs

The strict typing, architecture, and strict CRAP commands intentionally exit with an error against the recorded baseline. They are not added to CI in this change.

[rochecompaan]

Follow-up adoption work is tracked in #194.

The tracking issue covers the staged CI rollout, baseline-aware coverage/CRAP/type ratchets, the typebox architecture fix, mutation survivor triage and cadence, and the next property-test targets.

One terminology clarification for follow-up work: the current coverage and CRAP figures are the core bin/src baseline; shipped extensions code will receive a separate explicit baseline.