chore(ci): enforce oxlint warning ratchet in CI and pre-commit

[LeXwDeX]

What

Make the configured oxlint rules a mechanical merge gate.

• Root lint script now runs oxlint --max-warnings=4704 (current baseline). All configured rules are warn-severity, so plain oxlint exits 0 regardless — the ratchet is what makes new warnings fail.
• Run lint step added inside the existing required Typecheck check in ci-typecheck.yml, so lint failure blocks merges to dev and main immediately, with no ruleset changes.
• .husky/run-lint (mirrors run-typecheck's sandbox fallback) wired into pre-commit.
• Ratchet contract documented in .oxlintrc.json: when fixing existing warnings, lower the threshold.

Verification

• oxlint --max-warnings=4704 → exit 0; --max-warnings=4703 → exit 1 (gate proven)
• pre-commit hook ran lint + typecheck end-to-end on this commit