Add changed-file lint gate

[nkaradzhov]

Summary

• add ESLint flat config for JS and TypeScript files
• add a changed-file lint runner for PR CI and local staged/unstaged work
• run the lint gate once per pull request instead of across the full test matrix

Motivation

This gates lint quality for files changed by new PRs without requiring the existing monorepo lint debt to be fixed in one large pass.

Validation

• npm run lint:changed
• npm run lint:changed -- --base HEAD --head HEAD
• npm run build

---

Note

Medium Risk
Moderate risk because it changes CI behavior and can newly fail pull requests based on lint results or git diff detection (shallow fetch/base SHA handling). No runtime/product logic is affected.

Overview
Adds ESLint v9 with a new flat config (eslint.config.mjs) and new npm scripts (lint:changed, lint:all) to enforce consistent linting for JS/TS.

Introduces scripts/lint-changed.mjs, which determines changed files (PR base vs head in CI, or working tree locally), filters to lintable extensions while ignoring build/artifact paths, and runs ESLint with --max-warnings=0.

Updates GitHub Actions to run this lint gate once per pull request as a separate lint job (Node 22), instead of relying on the full test matrix to surface lint issues.

^{Reviewed by Cursor Bugbot for commit 086b8e3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 3968d41. Configure here.}