ci: install enforced gate baseline

[ElbertePlinio]

Summary

• enforce Rust Clippy complexity and function-size caps with strict warnings
• ratchet frontend coverage and enforce ESLint complexity, function-size, and depth caps
• add blocking gitleaks and OSV high/critical dependency gates behind one aggregate CI status
• update vulnerable transitive dependencies found during baseline installation

Validation

• bun install --frozen-lockfile
• bun run lint
• bun run check
• PATH="$HOME/.cargo/bin:$PATH" bun run test
• bun run test:coverage
• bun run build
• PATH="$HOME/.cargo/bin:$PATH" cargo clippy --manifest-path src-tauri/Cargo.toml --workspace --locked --all-targets -- -D warnings
• PATH="$HOME/.cargo/bin:$PATH" cargo llvm-cov report --manifest-path src-tauri/Cargo.toml --fail-under-lines 80 --summary-only
• gitleaks git --redact --no-banner
• osv-scanner scan source --recursive --all-packages --format json --output-file osv-results.json .
• node scripts/check-osv-severity.mjs osv-results.json bun.lock src-tauri/Cargo.lock
• TARGET_TRIPLE=x86_64-unknown-linux-gnu node scripts/prepare-playwright-sidecar.mjs --check
• actionlint .github/workflows/ci.yml
• GitHub Actions: Check and build, Dependency audit, Secrets scan, and CI gate all passed

Local macOS Rust tests reached 346 passed with three known environment-sensitive failures: two /proc process-marker tests and one sidecar timing test. The required CI command passed on Ubuntu.

Closes #69