ci: add the missing lint gate, and put typecheck in verify

Third instance of one scaffold defect. ai-forms (#11) and ai-ration (#2) had
exactly this, and so does threadkit:

  - No lint at all. ESLint was not a dependency, there was no config, and no
    script referenced it — so the fleet verify floor (lint AND typecheck AND
    test) was unmet.
  - `typecheck` existed but was not in `verify`. `build` is `tsc -p`, so types
    were checked only as a side effect of emitting. That conflates "compiles
    to dist" with "types are sound", and it evaporates the moment the build
    strategy changes.

verify = lint → typecheck → build → test.

Three repos with the same gap is a template problem, not three coincidences.
The instance is fixed here; the generator that produces `"verify": "npm run
build && npm test"` needs the same edit, or repo four is born with it. Naming
that explicitly rather than quietly fixing instance three — an un-encoded
"I'll remember" is the thing the never-twice rule exists to prevent.

Recommended presets only. ~500 lines of library code does not need a bespoke
rule set. Lint is clean on arrival, so this closes a hole rather than deferring
a backlog.

CI needs no change — ci.yml already calls `npm run verify` verbatim.

Verified: `npm run verify` passes — eslint clean, tsc clean, build clean,
31/31 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: catomean

eslint.config.mjs

@@ -0,0 +1,25 @@
+// Flat config (ESLint 9). Recommended presets only: this is ~500 lines of
+// library code, and a bespoke rule set would be a second opinion to maintain
+// for no benefit. The floor is "lint runs and can fail", not "lint encodes
+// taste".
+import js from '@eslint/js'
+import globals from 'globals'
+import tseslint from 'typescript-eslint'
+
+export default tseslint.config(
+  {
+    // dist/ is generated by `tsc`.
+    ignores: ['dist/**', 'node_modules/**'],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    files: ['**/*.ts'],
+    languageOptions: { globals: globals.node },
+  },
+  {
+    // Tests are plain Node running under `node --test`.
+    files: ['test/**/*.js', 'scripts/**/*.{js,mjs}'],
+    languageOptions: { globals: { ...globals.node, ...globals.nodeBuiltin } },
+  },
+)