chore(repo): consolidate tooling configuration into .config/ - #53

Two more tool configs into .config/, both passed by explicit path.

actionlint ran on defaults. Its config now declares an empty self-hosted-runner
label list and an empty config-variables list, which turns `vars.TYPO` from an
empty string that silently changes what a job does into a build failure --
verified by planting an undeclared variable and watching it fail.

markdownlint is new. Five relaxations, each with its reason in the file: MD033
allows `a` and `br` because the spec.md anchors are load-bearing (conformance
fixtures link to them) and `br` is the only in-cell line break; MD036 because a
bold lead-in is this repository's house style in every ADR; MD060 because it is
presentation, has no autofix, and adopting it would mean hand-realigning 263
table pipes across three normative spec.md files for no rendering difference.
pull_request_template.md is excluded from the glob: it is a form fragment
GitHub renders into a textarea, so MD041 would be asking it to grow a title.

The rest of the backlog was small enough to fix outright, and markdownlint made
both edits itself: two bare e-mail addresses are now autolinked, and three
double blank lines in spec.md are single. No prose changed.

Both flags verified live against a path that does not exist -- exit 3 and 2
respectively, not a silent fallback to defaults.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Merrell <merrelljustin@gmail.com>

One 330-line file held setup, build, eighteen checks, the CI entry points and
the ledger writes. It now holds the entry points and includes the rest, which
is the shape musher-dev/development-container and musher-dev/platform already
use.

Every pre-existing task name is unchanged -- CI, the hooks and CONTRIBUTING all
call them by name. `task --list` before and after differs only by the three new
tasks. Two mechanics make that hold, and both were traps worth recording in the
files themselves:

- A relative `dir:` in an included taskfile resolves against that file's own
  directory, so `dir: tools` would have silently meant `taskfiles/tools`. Every
  moved task uses `{{.ROOT_DIR}}`.
- A bare `task: check:format` inside an included file resolves within that
  file's namespace, as `ci:check:format`, and fails. The `ci` module anchors
  each reference to the root with a leading colon.

`check` and `setup` stay in the root rather than becoming a module `default`.
An included `default` is reachable as the bare namespace, but `task --list`
renders it `check:default`, which hides the command a newcomer most needs.

Also documents the new layout: CLAUDE.md gains .config/ and taskfiles/ in the
layout block and a non-negotiable for where tool config goes, and CONTRIBUTING
gains check:config and check:md in the table of what `task check` runs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Merrell <merrelljustin@gmail.com>

CONTRIBUTING.md, CODE_OF_CONDUCT.md and SECURITY.md are the three GitHub
resolves from .github/ as readily as from the root, and moving them leaves the
root holding the contract and the documents that describe it. Every link that
pointed at them moved in the same change; check:links is what proves it.

Three stay at the root, and not by omission:

- LICENSE and NOTICE, because .github/ is not a supported location for either.
  GitHub's license detection reads the root only, so moving LICENSE would drop
  the licence from the repository page and the API, and Apache-2.0 expects
  NOTICE to travel with the work.
- GOVERNANCE.md, which GitHub *does* support in .github/, because a normative
  spec.md links to it and so does every ADR. It is contract surface, and ADR
  0011's own test puts it at the root: what is visible there is content you
  read and edit, what is dotted is machinery that operates on it.

Renumbers the tooling-configuration ADR from 0007 to 0011. 0007 was already
taken by the naming-conventions ADR on the commit this branch started from.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Merrell <merrelljustin@gmail.com>

.editorconfig and devcontainer.json each stated whitespace, line endings and
encoding independently, and they disagreed. .editorconfig exempts Markdown from
trailing-whitespace trimming because two trailing spaces are a hard line break;
devcontainer.json trimmed unconditionally. In-container VS Code was quietly
reformatting prose against the rule the repository had written down.

musher-dev/development-container resolves this the other way -- it deletes
.editorconfig and keeps devcontainer.json -- and its own rationale names the
exception this repository falls under: those settings reach VS Code inside the
container and nothing else, so a project with contributors working outside it
should keep .editorconfig. CONTRIBUTING documents that path, and anyone may send
a patch to a public specification.

So .editorconfig keeps the whitespace rules and gains the reason for the
Markdown exemption, devcontainer.json drops the four duplicated keys, and the
EditorConfig extension is added so in-container VS Code actually reads the file.
devcontainer.json keeps what is genuinely VS Code's own: rulers, format-on-save,
formatter bindings, the local schema associations.

Recorded as ADR 0011 §6.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Merrell <merrelljustin@gmail.com>