task(//): migrate eslint -> oxlint; adopt @jlg 0.1.0 configs

[jgeschwendt]

Stacked on #550. Migrates jlg.io off the eslint stack onto the 0.1.0 shareable configs published from jgeschwendt/jlg (GitHub Packages, interim @jgeschwendt/* scope via npm aliases — source names stay @jlg/*).

Changes

• deps: drop 10-package eslint stack (incl. @next/eslint-plugin-next — oxlint's nextjs plugin covers all 21 rules 1:1); add oxlint + oxlint-tsgolint; bump oxfmt 0.57 → 0.59; aliases → npm:@jgeschwendt/{tsconfig,oxlint,oxfmt}@0.1.0
• .oxlintrc.json: extends @jlg/oxlint, type-aware enabled (tsgolint bundles typescript-go — repo stays on TS 6.0.3), every authored override from eslint.config.js ported (Icons.tsx, scripts/**, tsx casing split, proxy default-exports, Resume.tsx); eslint.config.js deleted
• .oxfmtrc.json: mirrors the @jlg/oxfmt base keys (printWidth: 80 → 12 files reflowed; sortPackageJson: false) + keeps local singleQuote/sortTailwindcss; wasm-bindgen output now ignored
• lefthook: adds staged-files oxlint pre-commit alongside oxfmt
• CI: NODE_AUTH_TOKEN now prefers a NODE_AUTH_TOKEN repo secret (falls back to GITHUB_TOKEN)

Dropped (no oxlint equivalent, both were warn-level)

• import/no-internal-modules allow-list
• linterOptions.reportUnusedInlineConfigs (unused-disable-directives survives as a CLI flag)

Gates

oxlint 0 errors / 32 warnings (restriction-category by design + 3 real staggerChildren deprecations in Main.tsx — motion 12.42 API migration, left visible) · oxfmt --check clean · tsc --noEmit clean · next build passes

CI auth (verified 2026-07-20)

All @jgeschwendt/* packages are public; the workflow GITHUB_TOKEN reads them fine (GitHub Packages still 401s anonymous reads, hence the env wiring).

🤖 Generated with Claude Code

Second commit: TS 7, JS tool configs, dep sweep (59f8173)

• typescript 7.0.2 — standalone tsc --noEmit clean. Next 16.2 cannot drive TS7's native API in-build (no createProgram); the unlock is @typescript/native-preview (Next's explicit escape hatch), plus ignoreBuildErrors as defense-in-depth and a bunx tsc --noEmit CI step as the enforced type gate.
• oxlint.config.ts — auto-discovered; evaluated under Node (≥22.18) even when invoked via bun, so node = "24" added to mise.toml for CI. JS-config extends takes objects (not paths); the JSONC base is loaded via jsonc-parser. Lint output proven identical to the JSON config (0 errors / 32 warnings, diff-identical).
• oxfmt.config.ts — imports the @jlg/oxfmt base live (with { type: "json" }) + local settings; -c wired into lefthook/CI/scripts (oxfmt doesn't auto-discover JS configs). Relative paths in the config resolve config-file-relative (verified).
• Dep sweep — ncu across the board; notable: vercel 54→56 (major, no breakage); next/react/motion already latest. New devDeps: @typescript/native-preview, jsonc-parser; resolveJsonModule enabled locally.
• Workflows — NODE_AUTH_TOKEN fallback experiment reverted to plain secrets.GITHUB_TOKEN.