…module files

The new docs:check drift gate (this same branch) immediately caught a real
bug on its first CI run: README claimed 2859 i18n keys while the actual
deduplicated count is 2849. Root cause is in sync-readme-metrics.mjs itself,
not just the (already-fixed-elsewhere) duplicate source keys — getKeyCount()
summed leaf counts per module file independently, so any key defined in two
files (as 10 keys were, until the PR #281 dedup fix) got counted twice. This
is a latent bug: it will silently drift again the moment any future PR
reintroduces a cross-module duplicate, regardless of today's specific fix.

Changed getKeyCount() to collect keys into a Set across all module files,
matching check-i18n-keys.mjs's loadBundleKeys() dedup logic exactly — the two
scripts can no longer disagree about the canonical key count.

…ce (#283)

* chore(repo): fix README badges, add Code of Conduct, link it from both CONTRIBUTING files

- README.md: removed the duplicate codecov badge (kept the more informative
  `&label=Coverage` one) and the CII Best Practices badge, which had a literal
  `projects/XXXX` placeholder (broken image, dead link) — the project was
  never registered. Added a TODO.md entry with the registration URL; that's
  an external, interactive signup, so it stays a maintainer action, not
  something this pass does automatically.
- Added .github/CODE_OF_CONDUCT.md (Contributor Covenant 2.1), with an
  enforcement-contact section that mirrors SECURITY.md's pattern (GitHub
  Private Vulnerability Reporting, no hardcoded personal email).
- .github/CONTRIBUTING.md already referenced a Code of Conduct but linked
  externally to contributor-covenant.org instead of the new in-repo file —
  repointed it.
- The root CONTRIBUTING.md — the one README.md actually links to — had no
  Code of Conduct section at all. Added one, linking to the new file.

Investigated (no code changes, per the workstream's stop-and-ask boundaries):
- The v1.5.0 GitHub release sits chronologically between v1.20.0 and v1.21.0
  despite its lower semver, AND its 6 assets are all named
  "StoryCraft.Studio_1.20.0_..." — the project's pre-rebrand name (rebrand to
  WorldScript Studio shipped in v1.23.0) with a version that doesn't match the
  release tag at all. Flagged for the final report; deleting/retitling a
  public release is a maintainer decision.
- Issue #60 (vendor-fork audit, "permanent reminder — do not close") already
  has a 2026-07-28 maintainer comment documenting the audit as done, and
  `pnpm run verify:vendor` passes all 12 invariants. No action needed — it's
  correctly staying open per its own instruction.

* chore(docs): truth-up locale counts + release status, add doc-metrics drift gate

ROADMAP.md still marked v1.24 as "(PLANNED)" though v1.24.0 (2026-06-21) and
v1.24.1 (2026-07-28) had both already shipped, and gave the locale count as
17 — stale since the 11->17 expansion (v1.24.0) plus ru/ko (landed the next
day, before v1.24.1). Same "17 locales" drift was independently present in
docs/TRANSLATION-GUIDE.md (also missing 1 of 21 modules — desktop.json — from
its module list and count), the root CONTRIBUTING.md (the one README.md
actually links to), .github/copilot-instructions.md (2 occurrences), and
docs/i18n/AUDIT_AND_IMPROVEMENT_PLAN.md's "current state" section. Fixed all
of them; left every CHANGELOG.md and dated AUDIT.md/TODO.md historical entry
untouched — they correctly describe what was true at a past release.

Added scripts/check-doc-metrics.mjs (wired into ci.yml's quality job as
`pnpm run docs:check`) so this class of drift fails CI instead of silently
accumulating again. It computes the actual locale count, key count (dedup'd
the same way check-i18n-keys.mjs does), and latest released version tag, then
scans README/ROADMAP/TODO/TRANSLATION-GUIDE/CONTRIBUTING for stale numbers or
a "vX.Y.Z ... PLANNED" claim for an already-released version.

Historical sections are exempt (Keep-a-Changelog `## [x.y.z]`, `## vX.Y.Z ...
RELEASED ...`, a heading suffixed with an emoji checkmark, a `**Status:** ✅
Released/Completed` line just below a heading, or this repo's own TODO.md "✅
= done" bullet convention) — the first version only recognized the
Keep-a-Changelog/RELEASED-heading shapes and produced 26 false positives
against TODO.md/ROADMAP.md's other historical conventions; broadened it
before wiring the gate in. tests/unit/checkDocMetrics.test.ts covers the
exclusion heuristic directly (the plan's explicit requirement — an untested
exclusion rule turns a drift gate into noise).

* chore(gates): document coverage-ratchet tooling, suppression-debt plan, mutation-testing status

- Re-pinned token-audit-baseline.json to the actual measured total (160,
  down from a stale 165 dated 2026-06-14) after WS-1..6 landed. Ratchets
  down only, per the project's hard rule against loosening a quality gate.
- Added scripts/check-coverage-ratchet.mjs: reads coverage/coverage-summary.json
  (added the `json-summary` reporter to vitest.config.ts — it wasn't being
  generated at all) and suggests raising a threshold when the measured value
  sits 2+ points above it, matching the "3 green runs, max 5 pts/quarter"
  rule already documented as a comment in vitest.config.ts but never
  mechanized. Wired into ci.yml as `continue-on-error: true` — informational
  only, never blocks the build; the ratchet decision stays with the
  maintainer.
- docs/CODE_QUALITY.md: added a Suppression Reduction Plan grouping all 33
  noExplicitAny suppressions (of 52 total, at an exact-match baseline with
  no headroom) into clusters by root cause and effort — no code changes,
  visibility only.
- docs/CI.md: corrected three places that still described Stryker mutation
  testing as part of the active `ci.yml` job graph (job-graph diagram, the
  `mutation` job's table row, and the CI-tier table) — it was removed from
  the merge pipeline on 2026-06-02 and now runs only via manual
  `workflow_dispatch` on mutation.yml. Documented why, how to trigger it,
  and the re-integration criterion.

* docs: resync README test-file-count badge (527→528) after rebase onto new main

* fix(scripts): dedupe sync-readme-metrics.mjs's i18n key count across module files

The new docs:check drift gate (this same branch) immediately caught a real
bug on its first CI run: README claimed 2859 i18n keys while the actual
deduplicated count is 2849. Root cause is in sync-readme-metrics.mjs itself,
not just the (already-fixed-elsewhere) duplicate source keys — getKeyCount()
summed leaf counts per module file independently, so any key defined in two
files (as 10 keys were, until the PR #281 dedup fix) got counted twice. This
is a latent bug: it will silently drift again the moment any future PR
reintroduces a cross-module duplicate, regardless of today's specific fix.

Changed getKeyCount() to collect keys into a Set across all module files,
matching check-i18n-keys.mjs's loadBundleKeys() dedup logic exactly — the two
scripts can no longer disagree about the canonical key count.

* fix: address CodeRabbit review wave on PR #283

Real bugs found and fixed:
- .github/CONTRIBUTING.md linked SECURITY.md as ../SECURITY.md, but that file
  lives at .github/SECURITY.md — a sibling of CONTRIBUTING.md, not one level
  up. The link resolved to a nonexistent repo-root file. CodeRabbit anchored
  this finding on .github/CODE_OF_CONDUCT.md, whose own (correct) sibling
  link I verified matches; the actual broken link was in CONTRIBUTING.md.
- .github/workflows/ci.yml's quality-job checkout never fetched tags, so
  check-doc-metrics.mjs's stale-PLANNED-status check (which reads `git tag`)
  silently no-oped in every CI run. Added fetch-tags: true.
- check-coverage-ratchet.mjs's JSON.parse had no try/catch — a truncated or
  invalid coverage-summary.json would throw uncaught, contradicting the
  script's own documented "always exits 0, never gates CI" contract. Now
  falls through to the same non-blocking skip message as a missing file.
- check-doc-metrics.mjs's TARGET_FILES list didn't include
  .github/copilot-instructions.md or .github/CONTRIBUTING.md, despite the
  script's own header comment naming both as files that had the exact stale-
  locale-count regression this gate exists to catch — a recurrence there
  would have passed docs:check silently.
- docs/CODE_QUALITY.md's suppression cluster table summed to ~53 against the
  stated 52/52 baseline. Recomputed exact per-cluster counts from
  `check-suppressions.mjs --details` (11 + 8 + 5 + 9 + 19 = 52) and corrected
  the useAppSelector/single-occurrence cluster file lists to match.
- README.md's project-tree comment still said "15 modules"; the doc-truth-up
  work elsewhere in this PR already established 19 locales × 21 modules.
- docs/CI.md's pipeline table said `tsc` where the actual quality-job step
  (and package.json) both use `pnpm run typecheck`.

Convention-only:
- Added the missing single-line QNBS-v3 rationale comments to
  check-doc-metrics.mjs (filesystem reads, tag lookup, drift scan, CLI
  orchestration) and check-coverage-ratchet.mjs (non-blocking contract).
- Collapsed checkDocMetrics.test.ts's multiline file-header rationale to one
  line.