Close the gaps the node block leaves open

[sehkone]

Closes #55.

blocks/node.md has not changed since it was written. The three repositories carrying it took it at adoption and no pass was ever made over their existing code, so an audit turned up not a repository that broke a rule but a set of places where the block does not say enough to decide the case in front of you.

What the audit found

A suppression read as compliance. The block forbids any flatly and separately allows a suppression carrying a comment, and never said whether the second reaches the first. All three consumers read that it does — 145 such suppressions, 14 in production, and not one of them bare:

// biome-ignore lint/suspicious/noExplicitAny: pg Pool minimal surface
customerPool: any,

Nine of the fourteen cite a connection handle whose type the dependency already exports. That is not a boundary where the type is unknown; it is a type someone chose not to write. Nothing in the block said so. The suppression rule also named only @ts-ignore and @ts-expect-error, so the biome-ignore every one of the 145 actually uses fell outside a rule plainly meant to reach it.

A ban with nowhere to go. NEVER use npx`` and nothing else — no spelling for a tool deliberately outside the dependency tree, and pnpm dlx nowhere in the block. Two consumers reach for `npx` in a scheduled workflow at four call sites. The prohibition was also unfounded as written: its neighbouring clause explains preferring the scripts, and that reason does not reach `npx`.

Nothing checked at all. as unknown as T appears 42 times in hand-written production code, 389 counting tests, and the block says nothing about it.

What changed

Six edits to blocks/node.md, all within the two sections it already has.

• The npx ban is grounded in what npx does, and names both replacements — pnpm exec for a dependency, pnpm dlx <tool>@<version> for a one-off, at an exact version and never a dist-tag
• Installs treat the lockfile as the authority, through pnpm install --frozen-lockfile in CI
• The suppression rule covers any TypeScript or Biome diagnostic, and rules out @ts-ignore outright
• A suppression is not a substitute for a type, and a comment recording the real type as inconvenient is not a reason — with what one does look like
• The rule against any names the boundaries data arrives across
• The double assertion is forbidden, binding hand-written code only

Grade

PATCH. Nothing is reversed or removed. Five of the six match what all three consumers already do, so this release changes no consumer code — @ts-ignore is at zero across all three, --frozen-lockfile is already universal, and the rest either ground an existing rule or settle a case the block never addressed. The double assertion is the one that creates follow-up work, and it creates it downstream.

Test plan

• python3 scripts/lint_blocks.py — blocks OK
• npx markdownlint-cli2 over the repository — 0 issues
• No line in blocks/node.md exceeds 76 columns
• Block names no repository, path, or product; pnpm and Biome are named because every consumer of this block is driven by both
• Commit body wraps at 72; CHANGELOG.md entry carries no issue or pull request references

Follow-ups, not in this PR

One issue per repository once this releases: 13 production any sites in one consumer and 1 in another, 42 double assertions across the three, and the four npx call sites. The block's remaining thinness — no testing rules, no logging rule, no error-handling section, and no requirement to name the exact lint invocation CI runs — is noted in #55 and left for its own issues.