build(repo): move lint, test and mutation settings to the root

[systemfsoftware-maker]

Lake 1, U5 (Evaluator) — stacked on #36.

Operator approval: Kiro, 2026-10-05 (GATE1).

• Root oxlint.shared.ts (the recommended preset plus the strict TypeScript tier), vitest.shared.ts (packageTestConfig(aliases)) and stryker.shared.ts (packageStrykerConfig(mutate)) hold the house settings. Each package config extends them and declares only its aliases and its mutate set.
• Both lint overrides are deleted (R67): preset 4.0.0 already accepts Gherkin step bodies outside it and node imports in build configs.
• Departure from the plan's file name: the plan named the root lint file oxlint.config.ts. .lintstagedrc.js lints each staged file under the nearest directory holding an oxlint.config.ts, so a root file with that name would turn root tooling files (commitlint.config.ts) into a type-aware lint target with no program. oxlint.shared.ts avoids that, and the setting stays in one root file.
• Root package.json gains @systemfsoftware/oxlint-config-recommended, @systemfsoftware/stryker-js and vitest, the three packages the shared files import. Root tsconfig.node.json type-checks the shared files; the package node program sets allowImportingTsExtensions (with noEmit) so its configs can import them by .ts path at runtime.
• Turbo: //#typecheck:node tracks the shared files; lint, test and mutation track $TURBO_ROOT$/<shared file>.
• tsconfig.base.json declares the one repo-wide unstable-API opt-in, effect/http (Kiro ruling, 2026-10-05): Effect 4.0.1 ships HTTP only under the unstable marker, and global-fetch-in-effect bans the fetch alternative.

QA

$ pnpm check:ci
check:ci exit=0
$ git grep -nE "'(off|warn)'|\"(off|warn)\"" -- '*oxlint.config.ts' '*oxlint.shared.ts'
(no output) override-grep exit=1
# sabotage: append `debugger;` to packages/starter/src/index.ts
$ pnpm --filter @TODO/starter lint
src/index.ts:2:1: error eslint(no-debugger): `debugger` statement is not allowed help: Remove the debugger statement
# reverted

Restack, 2026-10-06

The commit extending the opt-in to effect/observability left with the dropped traces layer (#45): it existed only for the OTLP exporter, and nothing in the trimmed stack imports that module. Gate at bbe39c1, in a clean worktree: pnpm install --frozen-lockfile and pnpm check:ci exit 0.

[kiro-systemf]

Conductor verdict: all checks green on 63786d6, 0 threads, no unchecked boxes, no starter-verify findings on this layer, hunt grep clean; squash tree == tested head tree.

[kiro-systemf]

Conductor verdict: all checks green on 63786d6, 0 threads, no unchecked boxes, no starter-verify findings on this layer, hunt grep clean; squash tree == tested head tree.

The merge-base changed after approval.

[kiro-systemf]

Conductor verdict: 7/7 green on 72a10ef; tree identical to reviewed 63786d6 (merge -s ours of main); 0 threads.