Phase 2 of the toolchain rollout: type safety.
- @astrojs/check + typescript devDeps (the Astro-native typecheck;
  tsc alone can't see .astro files)
- tsconfig: types:[bun] so bun:test resolves in *.test.ts (also pulls
  Node globals via bun-types' node reference)
- typecheck/test/gate scripts; gate grows each phase
- ci.yml runs 'bun run gate' before build, so every later phase is
  validated end-to-end by CI automatically

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Phase 3 of the toolchain rollout: formatting.
- prettier + prettier-plugin-astro + prettier-plugin-tailwindcss
- .prettierrc.json: singleQuote, printWidth 100, tailwindStylesheet
  pointed at the v4 entry (src/styles/global.css)
- .prettierignore: dist/.astro/node_modules/bun.lock, public (served
  verbatim), the synced docker-compose.example.yml, docs (design/plan
  artifacts whose fenced blocks aren't valid JS)
- format/format:fix scripts; gate grown to typecheck + format
- one-time repo-wide reformat

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Phase 4 of the toolchain rollout: linting + dead-code.
- oxlint (.oxlintrc.json): correctness=error, suspicious=warn; lints .ts
  and embedded .astro scripts. no-underscore-dangle off (noise on
  __dirname, _fbq, project analytics globals)
- knip: zero-config, Astro plugin auto-detected; respects .gitignore
- fixes: drop needless 'export' on internal interfaces (SectionColumn,
  ConsoleCta); replace unused Object.entries key with Object.values;
  scope-disable no-unused-expressions around the Meta Pixel vendor snippet
- .gitignore: .remember/ (local session state, like .superpowers/)
- lint/knip scripts; gate = typecheck + format + lint + knip

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Phase 5 of the toolchain rollout: finalize the gate.
- gate is now the full chain: typecheck -> format -> lint -> knip -> test
- ci.yml already runs 'bun run gate' (added in phase 2), so CI now
  enforces the complete chain on every push/PR
- no coverage threshold: relaxed for a website (tests run, but we don't
  gate on a percentage the way the library repo does)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Phase 6 of the toolchain rollout: edge security + hooks.
- secretlint (.secretlintrc.json, recommend preset): scans for committed
  secrets. .secretlintignore excludes the synced docker-compose example
  (its connection string is a commented-out template default, not a secret)
- bun audit: advisory, NON-blocking in CI (continue-on-error) and pre-push.
  Current advisories are transitive build-time deps (picomatch/js-yaml)
  with no static-site attack surface; Dependabot bumps them upstream
- .githooks/ (zero-dep, via core.hooksPath set by prepare script):
  pre-commit = secrets + format (fast); pre-push = gate + audit
- knip.json: ignore the secretlint preset (loaded via config, untraceable)
- secrets/audit scripts; secret scan added to CI

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

A continue-on-error step still surfaces a red 'exit code 1' annotation,
which reads as a failure on an otherwise-clean PR. Use '|| echo ::notice::'
so the step is green and advisories show as a blue informational notice
instead — matching the pre-push hook's non-blocking 'bun audit || true'.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>