ci: establish and reduce repository lint baseline

[hackobi]

Evidence

After repairing the workflow trigger configuration in draft PR #988, GitHub Actions executed successfully:

• Type Check: passed
• SonarCloud: passed
• SonarCloud Code Analysis: passed
• Lint: failed with 222 errors and 757 warnings

The lint findings are distributed across existing scripts, tests, and load-generator code. This is a repository baseline issue, not a regression from PR #988.

Goal

Make the lint check actionable without weakening the project rules or mixing broad cleanup into consensus changes.

Proposed sequence

1. Capture the full lint output as a versioned baseline artifact.
2. Group failures by directory and rule.
3. Fix one bounded directory/rule group per PR.
4. Keep consensus and production-path files prioritized over tooling-only warnings.
5. Require CI to show a reduced error count after each cleanup PR.
6. Remove any temporary baseline mechanism only after the error count reaches zero.

Acceptance criteria

• CI lint executes reliably after PR fix(ci): repair workflow trigger configuration #988 or an equivalent workflow repair lands.
• Error and warning counts are reproducible locally and in GitHub Actions.
• No global rule weakening is introduced solely to hide existing failures.
• Each cleanup PR identifies its before/after counts and affected paths.

[hackobi]

First bounded cleanup slice is available as draft PR #991: two quote-rule errors fixed in scripts/derive-pubkey.ts and scripts/gen-test-identity.ts. Targeted ESLint reports 0 errors (6 intentional no-console warnings); bun run type-check and git diff --check pass. No consensus files or lint rules changed.