chore: install enforced gate baseline

[ElbertePlinio]

Goal

Make this repository satisfy the v1 enforced gate baseline required for no-read local review.

Gate checklist

• Measure current Vitest coverage and ratchet existing floors without lowering them
• Add blocking ESLint complexity, function-size, and nesting-depth checks
• Add blocking gitleaks CI scanning
• Add blocking OSV scanning for all lockfiles and high/critical advisories
• Confirm exact-output install, typecheck, test, coverage, lint, build, secrets, and dependency checks locally
• Require the CI, Gitleaks, and dependency-audit status checks on main through branch protection
• Open a PR and leave it unmerged

Visible legacy debt

• Remove the 18 ESLint suppression directives after splitting the referenced legacy functions
• Remove the temporary low-severity esbuild advisory exception by 2026-10-23

Acceptance criteria

• Every v1 TypeScript gate is enforced and blocking in PR CI.
• Existing structural violations are explicitly suppressed with this issue reference and countable.
• Coverage floors follow the measured ratchet and are never lowered.