TypeScript workspace gate: Prettier, ESLint, root validate, CI #4864

Part of the agentic software factory tracker #4858, Wave 2. Proposed as S3 in docs/agent-guidance-inception.md (PR #4861) §9, from #4859.

Depends on

After Part 3 (#4863), whose root-guards CI job this extends and whose verify:format-coverage wiring allowance this removes. Supersedes #197.

Scope

This is the design decided in #4473.

• A root Prettier config, with format and format:check. everything's per-package Prettier setup folds into it.
• A root ESLint flat config:
  • type-aware
  • --max-warnings 0
  • @typescript-eslint/no-floating-promises at error
  • build output (dist/, coverage/) ignored
• Split fast tests from coverage. Every TS workspace's test currently runs vitest run --coverage. Make test the fast run, and move the instrumented run to a separate coverage script, which Bugs, Coverage, and SDK Wave 1 Part 1: TypeScript servers: extensive unit tests + per-file 90% coverage gate #4854 then gives its per-file thresholds.
• A per-workspace validate script in each TS server, running format:check → lint → build → test for that package only.
• A root npm run validate that aggregates them (npm run validate --workspaces), plus any root-only guards.
• Adapt verify:format-coverage and verify:typecheck-coverage from the Inspector, using workspace globs. Port scripts/lib/tsc-program.mjs (+ tests), which verify-typecheck-coverage imports. Both guards also import Part 3's lib/npm-scripts.mjs.
• typescript.yml keeps its per-package matrix, and each leg runs only its own package's validate, not the whole monorepo.
• Remove Part 3's temporary verify:format-coverage wiring allowance.
• Extend the root-guards CI job (created by Part 3, Skills infrastructure: .claude/skills/, verify:skills, skills:eval #4863) with what no package leg covers: root format/lint of root files, verify:format-coverage, verify:typecheck-coverage, test:scripts (the guard scripts' own unit tests, added by Part 3), and a shared-devDependency guard. That guard, adapted from the Inspector's verify:dep-lockstep, checks that every shared TS devDependency (typescript, vitest, @vitest/coverage-v8, prettier, @types/node) is declared with one range across workspaces, or hoisted to the root. Today typescript alone has three ranges.
• Add the rules to AGENTS.md. If Part 2 (AGENTS.md, AGENTS.md: the absolute rules; delete CLAUDE.md #4862) hasn't merged yet, hand them to it instead:
  • npm run format before committing
  • validate is the inner loop
  • lint has no warning tier
  • build output is never a gate target
  • no suppression through config

Acceptance criteria

• npm run validate passes on a clean checkout, and so does npm run validate -w <package> for each server.
• Each CI matrix leg gates only its own package, and the root-guards job gates the rest.
• CI fails on a divergent shared devDependency range.
• CI fails a PR that has a formatting or lint finding.
• Existing findings are fixed, not suppressed through config.

Branch

Targets v2/main. Closes #N won't auto-close an issue on a non-default branch, so close this one by hand on merge and move the card to Done.