Add repository-wide typecheck and lint gates; staged lint is not CI

[ctoth]

Problem

The repository has no authoritative static-analysis gate:

• .github/workflows/build-test.yml runs only npm ci and npm test.
• npm run typecheck exists but is not run in CI.
• Both lint and lint:staged invoke biome lint --staged, so there is no repository-wide lint script suitable for a clean CI checkout.

Current validation on master at 0ce34ae shows why this matters:

• npx tsc --noEmit --noUnusedLocals --noUnusedParameters reports 22 unused-code diagnostics, including dead methods/fields such as attemptChannelRecovery, clearBuffer, handleCancelTransfer, and subBuffer.
• npx biome lint src --max-diagnostics=200 reports 17 errors, 366 warnings, and 19 infos.

The normal typecheck passes only because unused-code checks are disabled, and staged lint cannot establish whole-repository cleanliness.

Acceptance criteria

• Keep a fast staged lint command for pre-commit use and add a distinct full-source lint command with explicit tracked paths.
• Resolve the current error-level Biome diagnostics without mass ignores or a generated suppression baseline.
• Enable noUnusedLocals and noUnusedParameters, deleting or correctly wiring the 22 exposed surfaces.
• Add npm run typecheck and the full-source lint command to the GitHub Actions job alongside npm test.
• CI fails on a deliberately introduced type error, unused production declaration, or full-source lint error.
• Do not weaken existing rules merely to make the new gate green; configure an exception only when the repository has a documented reason.