Install enforced CI gate baseline

[ElbertePlinio]

Goal

Make PickArena satisfy the v1 enforced gate baseline before no-read review is enabled.

Checklist

• Audit existing CI gates and record evidence
• Measure current web coverage and ratchet floors down to whole percentages
• Add blocking TypeScript/Svelte type and complexity checks
• Add blocking Vitest line and branch coverage floors
• Add blocking gitleaks secrets scan
• Add blocking OSV dependency audit over repository lockfiles
• Validate every new gate locally with exact commands
• Require the CI status checks on main
• Open a linked PR without merging

PR: #44