ci: add the missing lint gate, and put typecheck in verify

Same two gaps as ai-forms (fixed there in #11), from the same scaffold:

  - No lint at all. ESLint was not a dependency, there was no config, and no
    script referenced it — so the fleet verify floor (lint AND typecheck AND
    test) was unmet.
  - `typecheck` existed but was not in `verify`. `build` is `tsc -p`, so types
    were checked only as a side effect of emitting. That conflates "compiles
    to dist" with "types are sound", and it evaporates the moment the build
    strategy changes.

verify = lint → typecheck → build → test.

Recommended presets only. This is ~600 lines of library code; a bespoke rule
set would be a second opinion to maintain for no benefit. The floor is "lint
runs and can fail", not "lint encodes taste". Lint is clean on arrival, so this
closes a hole rather than deferring a backlog.

CI needs no change — ci.yml already calls `npm run verify` verbatim.

Verified: `npm run verify` passes — eslint clean, tsc clean, build clean,
31/31 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: catomean

eslint.config.mjs

@@ -0,0 +1,25 @@
+// Flat config (ESLint 9). Recommended presets only: this is ~600 lines of
+// library code, and a bespoke rule set would be a second opinion to maintain
+// for no benefit. The floor is "lint runs and can fail", not "lint encodes
+// taste".
+import js from '@eslint/js'
+import globals from 'globals'
+import tseslint from 'typescript-eslint'
+
+export default tseslint.config(
+  {
+    // dist/ is generated by `tsc`.
+    ignores: ['dist/**', 'node_modules/**'],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    files: ['**/*.ts'],
+    languageOptions: { globals: globals.node },
+  },
+  {
+    // Tests are plain Node ESM running under `node --test`.
+    files: ['test/**/*.js', 'scripts/**/*.{js,mjs}'],
+    languageOptions: { globals: { ...globals.node, ...globals.nodeBuiltin } },
+  },
+)