feat(public-site-content): How it works + Security pages, shared layout (#373)

.github/workflows/frontend.yml

@@ -40,6 +40,10 @@ jobs:
         working-directory: ./frontend-typescript
         run: npm ci
 
+      - name: Lint (baseline ratchet)
+        working-directory: ./frontend-typescript
+        run: npm run lint:ci
+
       - name: Run Vitest
         working-directory: ./frontend-typescript
         run: npx vitest run --coverage

CLAUDE.md

@@ -67,3 +67,17 @@ This is enforced, not just documented: `.claude/hooks/check_comment_brevity.py`
 (a `PreToolUse` hook on `Write`/`Edit`) denies any write that introduces a
 comment longer than that, so trim it before retrying rather than fighting the
 hook.
+
+## Frontend lint — fix on touch, never add to the pile
+
+`frontend-typescript` has a pre-existing lint backlog. Rather than block on
+fixing it all at once, CI enforces a ratchet: `BASELINE` in
+`frontend-typescript/scripts/check-lint-baseline.mjs` caps total ESLint
+problems, checked by `npm run lint:ci`. A push that adds new lint errors
+fails; one that fixes some should lower `BASELINE` to lock the win in. When
+you touch a file that already has lint issues, fix them as part of that
+change instead of leaving them for later.
+
+This is enforced, not just documented: `.github/workflows/frontend.yml` runs
+`lint:ci` on every push/PR touching `frontend-typescript/**`, and
+`scripts/git-hooks/pre-push` mirrors it locally (see WORKFLOW.md §8).

docs/development/WORKFLOW.md

@@ -161,8 +161,11 @@ rather than fast-forward-mergeable). Pass `--yes` to skip the prompt.
 (`black --check`, `mypy`, `flake8`) locally, scoped to whichever service(s) the
 push actually touches (a `shared/` change checks all four). A push touching
 `scripts/*.py` runs `black --check`, `flake8 --max-line-length=100` and
-`scripts/test_flow.py` over `scripts/` — the workflow tooling lints itself. The
-hook also rejects a branch whose name doesn't match §3. One-time setup:
+`scripts/test_flow.py` over `scripts/` — the workflow tooling lints itself. A
+push touching `frontend-typescript/*.{ts,tsx}` runs `npm run lint:ci`, the
+same ESLint baseline ratchet as `frontend.yml` (see CLAUDE.md's "Frontend
+lint" section). The hook also rejects a branch whose name doesn't match §3.
+One-time setup:
 
 ```
 git config core.hooksPath scripts/git-hooks

frontend-typescript/eslint.config.js

@@ -6,7 +6,7 @@ import tseslint from 'typescript-eslint'
 import { globalIgnores } from 'eslint/config'
 
 export default tseslint.config([
-  globalIgnores(['dist']),
+  globalIgnores(['dist', 'coverage']),
   {
     files: ['**/*.{ts,tsx}'],
     extends: [