fix(lint): clear remaining socket-registry lint errors

- .github/actions/lib/{check-firewall.mts,platform.mjs,jq.mjs}: per-call
  disables for fetch/console.error/console.log. Each runs on the raw
  runner before setup-node — @socketsecurity/lib-stable isn't installed
  yet, and platform.mjs/jq.mjs use stdout as the action's contract
  (consumed via command substitution).
- scripts/install-claude-plugins.mts: oxlint --fix added '| undefined'
  to 13 optional interface properties (pairs with exactOptionalPropertyTypes).
- test/packages.test.mts: oxlint --fix converted a for...of array loop
  to the cached-length form.
- scripts/npm/make-npm-override.mts: max-file-lines legitimate marker
  (interactive CLI driver, phases share live state).

Author: jdalton

.github/actions/lib/check-firewall.mts

@@ -44,6 +44,7 @@ const main = async (): Promise<number> => {
   const timer = setTimeout(() => controller.abort(), FIREWALL_TIMEOUT_MS)
   timer.unref?.()
   try {
+    // oxlint-disable-next-line socket/no-fetch-prefer-http-request -- composite-action helper runs on the raw runner before setup-node; @socketsecurity/lib-stable not installed yet.
     const res = await fetch(url, {
       headers: {
         'User-Agent': 'socket-registry-setup-action/1.0',

.github/actions/lib/jq.mjs

@@ -27,4 +27,5 @@ if (v == null || v === '') {
   process.exit(1)
 }
 
+// oxlint-disable-next-line socket/no-console-prefer-logger -- composite-action helper runs on the raw runner before setup-node; the action's stdout IS the contract (consumed via shell command substitution).
 console.log(typeof v === 'string' ? v : JSON.stringify(v))

.github/actions/lib/platform.mjs

@@ -23,6 +23,7 @@ const arch = archMap[process.arch]
 const platform = platformMap[process.platform]
 
 if (!arch || !platform) {
+  // oxlint-disable-next-line socket/no-console-prefer-logger -- composite-action helper runs on the raw runner before setup-node; @socketsecurity/lib-stable not installed yet.
   console.error(`× unsupported runner: ${process.platform}-${process.arch}`)
   process.exit(1)
 }
@@ -53,4 +54,5 @@ if (platform === 'linux') {
   }
 }
 
+// oxlint-disable-next-line socket/no-console-prefer-logger -- composite-action helper runs on the raw runner before setup-node; the action's stdout IS the contract (consumed via `id: detect` output).
 console.log(`${platform}-${arch}${suffix}`)

scripts/install-claude-plugins.mts

@@ -1,3 +1,4 @@
+/* max-file-lines: legitimate — interactive override-generator CLI; the package-extract / license-resolve / template-pick / file-write phases share enough live state (origPkgName, sockRegPkgName, nmPkgJson, licenseContents) that splitting them produces a tangle of cross-file mutables. Only a few LOC over the soft cap. */
 /**
  * @file Creates Socket registry package overrides for npm packages. Interactive
  *   CLI tool that guides users through creating secure package overrides:

scripts/npm/make-npm-override.mts

@@ -193,7 +193,8 @@ for (let i = 0, { length } = ecosystems; i < length; i += 1) {
             )
 
             // For each JS file, check if there's a corresponding type file.
-            for (const jsFilePath of jsFilePaths) {
+            for (let i = 0, { length } = jsFilePaths; i < length; i += 1) {
+              const jsFilePath = jsFilePaths[i]!
               // Check if there's any type file in the exports.
               // This is a simplified check - just ensure type files exist somewhere.
               if (!typeFilePaths.length) {
@@ -205,6 +206,7 @@ for (let i = 0, { length } = ecosystems; i < length; i += 1) {
                 const relativeDtsPath = trimLeadingDotSlash(dtsFilePath)
                 expect(files.includes(relativeDtsPath)).toBe(true)
               }
+            
             }
           })
         }