Fix CI lint/typecheck regressions; retire Radicle-era install + p2p workflows

CI's check-all had been red since rc.21 (the rc.21 tag triggered only the
Release workflow, so the lint regression slipped through).

Lint fixes:
- eslint.config.mjs: add WebSocket + process to the globals allowlist
  (bridge-client.ts used them, no-undef flagged every reference)
- settings-sync.ts: SYSTEM_LEVEL_KEYS was a runtime const used only as a
  type — converted to a pure type union
- eslint --fix swept now-redundant `eslint-disable no-undef` directives
  across 6 files (process/WebSocket are valid globals now)

Typecheck fix:
- vault-service.ts writeFileBuffer: Buffer.from can't resolve against the
  bare ArrayBuffer | Uint8Array union; normalize to a Uint8Array view first

CI workflow cleanup:
- ci.yml: removed the install-script-syntax + install-verify-{linux,macos,
  windows} jobs and the `changes` path-filter. They tested install.sh /
  install.ps1 — the pre-pivot Radicle shell installer that the Tauri
  daemon's first-run flow fully replaced. ci-summary now depends only on
  check-all.
- p2p-collaboration.yml -> .github/workflows-disabled/p2p-collaboration.yml.bak.
  Radicle/Tailscale P2P E2E test; its push path-filter watched the exact
  feature dirs the pivot churned, so it failed on every commit. Parked as a
  recoverable backup with a README on how to revive it against the GitHub
  transport.

Local CI suite now green: lint + typecheck + 419 tests all pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ProjectLiminality

.github/workflows-disabled/README.md

@@ -0,0 +1,28 @@
+# Disabled workflows
+
+Workflows parked here are **not run by GitHub** — Actions only picks up
+`.yml` files directly inside `.github/workflows/`. They're kept as
+recoverable backups, not deleted.
+
+## `p2p-collaboration.yml.bak`
+
+End-to-end P2P collaboration test from the **Radicle era** (pre-rc.21).
+Exercised `rad init` / `rad clone` / `rad push` on a single runner, plus a
+manual multi-runner mode that connected two VMs over a Tailscale VPN.
+
+Disabled in the rc.22 cleanup because:
+
+- rc.21's "Great Simplification" replaced Radicle with GitHub as the
+  collaboration transport — every `rad` command in this workflow is now
+  dead infrastructure.
+- Its `push` path filter watched `src/features/social-resonance-filter/**`,
+  `src/features/coherence-beacon/**`, and `src/features/dreamnode-updater/**`
+  — exactly the files the pivot churned — so it failed on every commit.
+
+**To revive it**: rewrite the Alice/Bob test bodies against the GitHub
+transport — `gh repo create` for outbox setup, `git clone`/`git fetch` over
+HTTPS instead of `rad clone`, the sovereignty-handover dance (rename cloned
+`origin` → peer remote, create own outbox), and coherence-beacon propagation
+through `git commit -F` beacon commits. The job *structure* (single-runner
+localhost mode, two-peer fixtures) is still a fine skeleton; only the
+transport calls need swapping. Then move it back into `.github/workflows/`.