chore(repo): consolidate tooling configuration into .config/

[justinmerrell]

What changes

Consolidates every tool configuration into .config/, adopting the convention
musher-dev/development-container and musher-dev/platform already share, and
makes it a build failure rather than a comment. Along the way: two new linters,
the Taskfile.yml split into modules, and the community health files moved into
.github/.

Nothing under specifications/ or conformance/ changes behaviour, and no
commit is scoped to a family — this releases nothing.

The layout

.config/
  README.md                     the index: every file, its tool, how it is reached
  lefthook.yml                  top level by necessity -- see the trap below
  actions/actionlint.yaml       -config-file
  markdown/markdownlint.jsonc   --config
  spelling/cspell.json          --config
  spelling/musher.txt           dictionary, reached from cspell.json
taskfiles/                      Task modules included by the root Taskfile.yml

Root keeps only what can be nowhere else: Taskfile.yml, .gitignore,
.gitattributes, .editorconfig, LICENSE, NOTICE, README.md,
GOVERNANCE.md, and the two published data artifacts. tools/biome.json and
tools/tsconfig.json stay with their package.

The gate

tools/src/config.ts (task check:config) enforces CFG-01..CFG-08 with the
same codes the sibling repositories report from their Python repo config check — three repositories, one convention, one vocabulary. config.test.ts
provokes every code against a throwaway tree, because a gate that cannot fail is
indistinguishable from no gate.

Two silent failures this found

cspell's globRoot. cspell resolves ignorePaths against the config file's
own directory, so moving it two levels down re-rooted every repo-relative ignore
against .config/spelling/, where none matched. The check kept passing while
covering strictly less. Caught by comparing file counts (53 before, 53 after),
not by a red build — a check that has stopped enforcing anything does not fail.
globRoot is now explicit.

.editorconfig vs devcontainer.json. Both stated whitespace independently
and disagreed: .editorconfig exempts Markdown from trailing-whitespace
trimming because two trailing spaces are a hard line break, devcontainer.json
trimmed unconditionally. In-container VS Code was reformatting prose against the
repository's own rule. .editorconfig is now the single source.

New linters

• actionlint gains a config. config-variables: [] turns vars.TYPO from an
  empty string that silently changes a job into a build failure — verified by
  planting one.
• markdownlint is new, pinned in tools/. Five relaxations, each with its
  reason in the file. MD060 is off: it has no autofix, and adopting it meant
  hand-realigning 263 table pipes across three normative spec.md files for no
  rendering difference. The rest of the backlog was fixed — two bare e-mail
  addresses autolinked, three double blank lines closed.

Every new flag was verified live against a path that does not exist, so a
silently-ignored --config cannot hide behind a green build.

Taskfile split

Every pre-existing task name is unchanged; task --list differs only by
check:config, check:md and fmt:md. Two traps are recorded in the files: a
relative dir: in an included taskfile resolves against that file's
directory, and a bare task: check:format inside an included file resolves
within its own namespace.

Community health files

CONTRIBUTING.md, CODE_OF_CONDUCT.md and SECURITY.md moved to .github/.
LICENSE and NOTICE cannot — GitHub detects a licence at the root only.
GOVERNANCE.md could, but a normative spec.md links to it and so does every
ADR: it is contract surface, not a community file.

Why

Root dotfiles accumulate because every tool's README says to put them there, and
nothing distinguishes root-by-necessity (Git, EditorConfig, Task) from
root-by-default (lefthook, cspell). Platform shipped the prose version of this
rule with no gate and watched two non-configs accrete inside the directory and
four lint tools run on defaults. Rationale in
ADR 0011.

Verification

• task check green locally, including all three new checks.
• task --list diffed before and after the split: only the three new tasks.
• Each CFG-0N provoked deliberately and confirmed to fire, then reverted.
• Hooks reinstalled from scratch (rm -rf .git/hooks && task setup:hooks) and
  observed running from .config/lefthook.yml, including the new config job.
• git status clean under conformance/; the two byte-sensitive -text parser
  fixtures untouched.

Known gap

YAML linting is not in this PR. yamllint is Python-only and this dev
container deliberately ships no Python or uv — its header says so. The agreed
alternative, google/yamlfmt in lint mode, could not be installed either: this
environment truncates large release downloads from GitHub's asset CDN, so it
could not be run or its output evaluated even once. Adding a check whose first
real execution is in CI would break the rule this PR just wrote down. Worth a
follow-up from a machine that can run it.