Install the enforced TypeScript gate baseline

[ElbertePlinio]

Goal

Install the TypeScript gate baseline so every required check blocks pull requests.

Checklist

• Measure current line and branch coverage before changing floors
• Add blocking ESLint complexity, function-size, and nesting caps
• Ratchet Vitest line and branch coverage floors without lowering existing thresholds
• Add blocking gitleaks CI coverage
• Add blocking osv-scanner coverage for all lockfiles
• Verify typecheck, tests, lint, coverage, secrets scan, and dependency audit locally
• Require test, gitleaks, and dependency-audit on main
• Open PR ci: install the enforced TypeScript gate baseline #61

Follow-up debt

• Remove the 48 per-site ESLint suppression comments (57 legacy rule findings)
• Review the 6 synthetic-secret Git-history fingerprints if fixture history changes
• Upgrade the upstream ranges for @hono/node-server and esbuild, then remove the 2 below-threshold OSV exceptions

Baseline

gate-baseline.md v1, TypeScript packages profile.