chore: adopt ts-canon for the lint/format toolchain

[SynthLuvr]

What

Wave-1 migration to ts-canon (per its design doc). The lint/format toolchain this template duplicated becomes one devDependency: ts-canon@^0.1.0 from npm (published 2026-08-27; the earlier github: commit pin was only a stopgap while it was unpublished).

• pnpm lint → ts-canon lint: biome, oxlint+tsgolint, 3 ast-grep rules, pandoc, peer-deps, pnpm audit --prod, jscpd — same steps, same order as before
• pnpm format → ts-canon format: arrows → braces → biome format → biome check → pandoc — same order as before
• scripts/{oxlint,pandoc-md,peer-deps}.mts and .ast-grep/rules/ deleted (ported into ts-canon; verified equivalent)
• biome.json collapses to extends ts-canon/presets/biome.preset.json (config was verified identical modulo $schema)
• tsconfig.json extends ts-canon/presets/tsconfig.base.json
• sgconfig.yml copied from the preset so bare ast-grep scan/editor integrations still find the rules
• vitest.config.ts imports ts-canon/presets/vitest — the preset ships compiled (vitest.mjs + vitest.d.mts, dedicated exports entry; fix: make migrate, the vitest preset, and doctor work from real installs ts-canon#3), so it loads from real installs
• typescript, vitest, @vitest/coverage-v8, @types/node stay consumer-side; .oxlintrc.json unchanged
• pnpm-workspace.yaml: adds minimumReleaseAgeExclude: ts-canon@0.1.0 — pnpm's supply-chain age gate (24h) rejects the just-published release, and without the exclusion pnpm install --frozen-lockfile fails with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION. The entry is inert where no age policy is active, and becomes droppable once the release is >24h old
• README/AGENTS updated for the ts-canon workflow; CI workflow unchanged (script names identical)
• Net −506 lines

Verification

• Baseline pre-migration: build/lint/test green in the worktree
• Cold rm -rf node_modules && pnpm install --frozen-lockfile (what CI does) — against the npm registry
• Published tarball inspected: presets (biome/tsconfig/vitest compiled pair), rules, src, bin all shipped
• pnpm build — tsc resolves the preset extends through the install
• pnpm lint — all 9 steps pass, biome checked 7 files via the preset extends
• pnpm test — 3 tests, 100% coverage; config loads ts-canon/presets/vitest from node_modules (no ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING)
• pnpm format idempotent
• pnpm lint --fast skips audit/jscpd; path args work
• ts-canon migrate --dry-run — "would set ts-canon to ^0" (registry spec; git installs are preserved per fix: make migrate, the vitest preset, and doctor work from real installs ts-canon#3)
• ts-canon doctor — node 26.7.0, pandoc 3.10.2, all bundled tools, consumer typescript 7.0.2; pnpm detected under pnpm exec via packageManager
• Windows CI (matrix) — to be confirmed by this PR's checks

ts-canon follow-ups

None. All four items from the original draft are resolved: npm publishing (0.1.0 is live), migrate preserving non-registry specs + --version flag, the compiled vitest preset, and doctor's packageManager fallback — the latter three in SynthLuvr/ts-canon#3.

[SynthLuvr]

Now that SynthLuvr/ts-canon#3 is merged, rebased this PR onto it (e4c9eed):

• Pin bumped ef074c9 → 2f1fa25 (ts-canon main after chore(deps): update all dependencies and pnpm to latest #3). Still a git pin — ts-canon remains unpublished on npm (registry 404).
• vitest preset adopted: vitest.config.ts now imports ts-canon/presets/vitest instead of carrying an inline copy. The compiled preset (vitest.mjs/vitest.d.mts) loads fine from node_modules — pnpm test green, 100% coverage.
• Consumer-side checks of the chore(deps): update all dependencies and pnpm to latest #3 fixes: migrate --dry-run keeps the github: spec; doctor under pnpm exec reports ok pnpm — 11.22.0 (packageManager).

pnpm build && pnpm lint && pnpm test all green. PR description updated — the only remaining upstream ask is npm publishing.

[SynthLuvr]

ts-canon is on npm now (0.1.0, published 2026-08-27), so this PR switches off the stopgap git pin (b68842a):

• github:…#2f1fa25 → ^0.1.0 from the registry — I verified the published tarball ships everything the template consumes (biome/tsconfig presets, compiled vitest preset, rules, src/, bin/).
• One wrinkle: pnpm 11's minimumReleaseAge supply-chain gate rejects packages younger than 24h, so pnpm install --frozen-lockfile failed against the fresh release (ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION). pnpm-workspace.yaml now carries minimumReleaseAgeExclude: ts-canon@0.1.0 (pnpm's own remediation, scoped to the exact version). It's a no-op where no age policy is active and can be dropped once 0.1.0 is >24h old.
• AGENTS.md wording: "bump the pinned commit" → "bump its version".

Re-verified from the registry install: pnpm build && pnpm lint && pnpm test green (3 tests, 100% coverage), doctor clean, migrate --dry-run now says "would set ts-canon to ^0", pnpm format idempotent. PR description updated — no upstream follow-ups remain.