chore(quality): add cross-platform enforcement gates

[aaf2tbz]

Summary

Add the enforcement and governance layer for #919: one Linux/macOS quality workflow spanning TypeScript/JavaScript and Rust, local prevention hooks, ownership, package/dead-code baselines, and non-bypassable PR guards. This is PR 4 of the quality-hardening sequence and closes the issue when merged.

Changes

• Added one cross-platform quality workflow for JS/TS lint/tests, Rust format/Clippy/check/test/dependency policy, package validation, and CI/shell/Docker meta-lints.
• Added advisory Knip and publint/Are the Types Wrong baselines so existing debt is visible and measurable.
• Added an executable staged-file pre-commit hook plus hooks:install.
• Added CODEOWNERS for quality-critical CI, release, Rust, and migration paths.
• Removed every checklist-exception bypass from readiness, bugfix-regression, and migration guards.
• Updated contributor guidance with actual local commands and the post-chore(daemon): clear tsc backlog so the typecheck gate can go hard-required (#961) #969 branch-protection activation requirement.

Type

• feat — new user-facing feature (bumps minor)
• fix — bug fix
• refactor — restructure without behavior change
• chore — build, deps, config, docs
• perf — performance improvement
• test — test coverage

Packages affected

• @signet/core
• @signet/daemon
• @signet/cli / dashboard
• @signet/sdk
• @signet/connector-*
• @signet/web
• predictor
• Other: CI, repository governance, developer tooling, and contributor workflow

Screenshots

N/A — no UI behavior change.

PR Readiness (MANDATORY)

• Spec alignment validated (INDEX.md + dependencies.yaml)
• Agent scoping verified on all new/changed data queries
• Input/config validation and bounds checks added
• Error handling and fallback paths tested (no silent swallow)
• Security checks applied to admin/mutation endpoints
• Docs updated for API/spec/status changes
• Regression tests added for each bug fix
• Lint/typecheck/tests pass locally

Migration Notes (if applicable)

No schema or migration semantics changed.

• Migration is idempotent
• Daemon Rust parity reviewed or explicitly N/A
• Rollback / compatibility note included in PR description

Testing

• bun test passes (run on fresh main: 1,043 pass, 46 skip, 209 existing failures; details below)
• bun run typecheck passes (remains advisory until #969)
• bun test scripts/quality-gates-workflow.test.ts passes
• bun test scripts/check-publish-manifests.test.ts passes
• bun run check:publish-manifests passes
• Shared @signet/core and @signet/connector-base builds plus focused connector-base tests pass
• Workflow YAML, hook syntax, package JSON, and git diff --check validated
• N/A — no running-daemon behavior changed

AI disclosure

• No AI tools were used in this PR
• AI tools were used (see assisted work in this session)

Notes

This was created from a clean SSD worktree at the latest origin/main. Dependencies were installed with PUPPETEER_SKIP_DOWNLOAD=1, so no Puppeteer browser binary was downloaded.

bun test currently exposes baseline failures in route parity, a stale web content index, and workspace-package resolution; the new workflow makes those failures visible rather than masking them. Knip reports 372 unused files / 110 unused exported types, and package API lint reports existing publish-output and export-order findings, so both are advisory baselines for now.

The Rust and Biome enforcement commands rely on the preceding baseline PRs #1034 and #1036. After those land and #969 clears the TypeScript backlog, repository administrators must make the workflow checks required, require review, and block direct pushes to main in branch protection.

Closes #919