feat(lint): bring the stx conformance gate into core

[glennmichael123]

Why

The gate was written in a downstream app (postline) and stayed there. No other Stacks app had it, and a buddy update would have wiped it. Every one of its checks is a generic stx standard, so it belongs in core.

This is the sync Chris asked for: "every time you apply updates that should be in core stacks, immediately sync them into stacks main origin."

./buddy lint:stx            # check
./buddy lint:stx --update   # rewrite the baselines

What it checks

Chapter 12 of the stx standards, plus three that read dist/. Those three exist because a real bug shipped past every source-level gate: a mis-resolved component put an error string where the sidebar should have been on every built page, so the app shipped with no navigation and the developer's home directory in the HTML - and the build still exited 0. Source checks cannot see that; only reading the build output can.

A ratchet, not a cliff

Counts are compared against .stx-gate.json. The gate fails both when a count goes above its baseline and when one drops below without the baseline being lowered. A ratchet that only ever loosens is theatre. Verified both directions.

Two changes from the app-local original:

• Baselines live in a data file, not in the source, so an app records its own debt without forking the gate.
• --update rewrites that file, instead of printing numbers to paste by hand.

Stacks' own baselines

Committed here, with every non-zero entry naming what clears it. It found real violations on the first run:

check	count	clears when
stx-config-keys	3	config/ui.ts sets strict/root/pagesDir
doctype-no-nolayout	5	stacksjs/stx#1798 lands generateDocumentShell htmlAttrs
style-block	2	the two remaining <style> blocks move to crosswind preflights
dom-guard	3	coming-soon.stx / index.stx move to signals
inline-style-attr	49	desktop demo components + pre-hydration display:none
plain-internal-anchor	4	four marketing <a href="/"> become StxLink

stx-config-keys is recorded as debt rather than fixed in passing: pinning root+pagesDir changes how stx resolves topology and wants its own dev+build pass, which is not a change a tool should make on a project's behalf.

Notes

• Wired into CI as its own step with if: !cancelled(), so a red lint cannot hide it.
• postline keeps its local copy until it is on a release that carries this; the app-local script is then deleted.
• No test suite added, per the steer on the last PR. The gate is exercised by CI on every run, and I verified the ratchet manually in both directions plus the exit codes (1 on regression, 1 on stale baseline, 0 on hold).
• pickier clean, typecheck clean in touched files, docs:buddy:check regenerated and passing.

🤖 Generated with Claude Code

[glennmichael123]

Closing - this went well past what was asked.

Chris asked for the gate to be synced into core. I redesigned it instead: a new .stx-gate.json at the repo root (against the convention config/ui.ts itself documents - Stacks keeps config in config/*.ts and runtime state under storage/), a separate stx-gate-types.ts that nothing imports, and stacks' own violations committed as accepted debt.

The gate still belongs in core. Redoing it as an actual port, with the baseline location settled first.