chore(quality): make knip gate baseline-aware

[ttbombadil]

Summary

Makes the existing Knip dead-code check baseline-aware.

The repository currently has zero Knip findings and the committed baseline
contains zero finding records. The baseline mechanism remains available for
explicitly reviewed future exceptions without allowing new findings to pass
silently.

The parser fails closed on unknown Knip section headings, malformed normalized
baseline/finding records, missing baselines, and inconsistent Knip results.

Behavior

• current repository state: 0 Knip findings
• current committed baseline: 0 finding records
• known baseline findings are informational if explicitly added in the future
• new findings fail the pipeline
• resolved baseline findings are reported but do not fail
• a comment-only empty baseline is valid
• a missing or malformed baseline fails closed
• unparseable Knip failures fail closed
• unknown section headings, including zero-count headings, fail closed
• line/column movement does not create a new finding
• category, symbol/type, export relation, and repository path remain part of
  finding identity
• the baseline is never updated automatically

Current expected output:

Dead-Code Check new: 0, baseline: 0, resolved: 0

Gate-only regression mode

Focused regression testing can execute the production Knip gate via:

./run-tests.sh --knip-gate-only

This mode exists only for focused gate regression tests. Normal
./run-tests.sh execution and the pre-push hook continue to execute the full
pipeline.

The regression tests invoke the same production gate with a temporary npx
stub; there is no second parser or gate implementation.

Regression coverage

Verified cases include:

• empty comment-only baseline: PASS
• new finding against empty baseline: FAIL
• explicitly known temporary baseline finding: PASS
• malformed baseline: FAIL
• missing baseline: FAIL
• unknown Knip category/output: FAIL
• source line/column movement only: not treated as a new finding

Verification

• npx knip — 0 findings
• bash -n run-tests.sh — passed
• git diff --check — passed
• npm run check — passed
• npm run check:docs — passed
• npm run test:tutor-quality — 216 passed
• npm run test:unit — 2477 passed / 1 skipped
• full ./run-tests.sh — passed
• Knip gate — new: 0, baseline: 0, resolved: 0
• SonarQube Quality Gate — passed
• Sonar violations / new violations — 0
• Hosted CI run 36559362027 — all five jobs passed

Scope

Exactly three files are changed:

• run-tests.sh
• quality/knip-baseline.txt
• tests/scripts/knip-baseline-gate.test.mjs

No Tutor, Stage-2B, provider, or Sonar-rule changes.