[Chore/Enhancement] - Strengthen lint / format / static-analysis gates across all repos

[DerekCorniello]

Goal

Make every muxlang repo enforce a consistent, strict, and declarative set of
lint / format / static-analysis gates, so "10/10 idiomatic code" is checked by
tooling rather than by hand. This is a survey of what each repo enforces today
and what is missing, grouped by repo type. Nothing here is committed yet - it is
a menu to pull work items from.

What already exists (strong baseline)

Every code repo already has: path-gated CI, fast pre-commit hooks that mirror
CI (except mux-syntax-highlighting and mux-examples), a SonarCloud "zero new
issues" gate, and pinned action SHAs for the sensitive actions. The gaps below
are about strictness and coverage, not starting from zero.

Relationship to existing issues

• Complements [Refactor/Chore] - Rework CI/CD pipeline, benchmarks, valgrind, checks, etc. #27 (CI rework: speed / flakiness / observability / Blacksmith).
  That issue is about how the pipeline runs; this one is about what it
  checks. They can proceed independently.
• Not Formatter support (senior project topic) #17 (a formatter for the Mux language itself). This issue is about
  linting/formatting our own repo source (Rust/TS/Python/JS), not .mux code.

---

Cross-cutting (all repos)

Add	Why	Priority
actionlint + shellcheck on .github/workflows/**	The workflows contain substantial shell-in-YAML (valgrind loops, Sonar curl/jq). actionlint catches YAML/expression bugs; shellcheck catches the embedded shell.	Med
ASCII-only gate	The ASCII-only rule is a documented invariant (AGENTS/skill) but enforced nowhere. A tiny grep gate in each repo would enforce it.	Med
Dependabot (or Renovate) config	None exists in any repo. Keeps actions + deps patched, and surfaces advisories.	Low-Med

---

Rust: mux-compiler and mux-runtime

These two mirror each other (same toolchain, same hook/CI shape), so treat them
together.

Have: cargo fmt --check, cargo clippy --all-targets --all-features -D warnings, tests + llvm-cov coverage, Valgrind, rc-leak-check, Sonar gate.
mux-compiler also has clippy.toml (cognitive-complexity = 15).

Add	Why	Priority
[lints] table in Cargo.toml	Lint policy lives only in the -D warnings CLI flag (duplicated across hook, run-checks.sh, AGENTS). Plain cargo clippy or rust-analyzer in the editor is therefore not strict. A [lints.rust] / [lints.clippy] table makes the policy declarative and enforced everywhere regardless of invocation.	High
Opt into clippy::pedantic (selectively)	Today only the default clippy group runs. Pedantic is where most "idiomatic" nudges live. Enable via the [lints] table, allow-listing the few noisy ones.	High
rust-toolchain.toml pinning 1.93.1	The toolchain is pinned only in CI YAML. clippy lints and rustfmt output change between compiler versions, so local/pre-commit results can drift from CI. Pin it for everyone.	High
cargo-deny (advisories, licenses, bans, duplicate versions)	No supply-chain gate today. Standard hygiene for a public compiler pulling inkwell/clap/phf/etc. cargo audit is the lighter alternative.	Med-High
rustdoc check: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps	Nothing guards broken intra-doc links or missing docs, though AGENTS asks for rustdoc on public APIs.	Med
rustfmt.toml with import grouping (imports_granularity, group_imports)	Would auto-canonicalize the messy/duplicated use blocks. Note: these two options are nightly-rustfmt only today.	Low-Med
clippy.toml in mux-runtime	Runtime has none, so the cognitive-complexity cap the compiler enforces is not applied there.	Low
Declare MSRV (rust-version)	Minor correctness/clarity for a published crate.	Low
Sweep scattered #[allow(dead_code)]	~7 in the compiler; prefer deleting dead code (or cfg-gating) over blanket-allowing.	Low

---

Python: mux-website-api

Have: py_compile, import smoke check, pytest + coverage, Sonar gate,
hash-pinned requirements.lock (good integrity story).

This is the biggest gap: the repo has no linter, no formatter, and no type
checker at all.

Add	Why	Priority
pyproject.toml	Central config the tools below read. Enabler for everything else.	High
Ruff (lint + format + import sort)	One fast tool replaces flake8 + black + isort. Single highest-value add in this repo.	High
mypy (or pyright)	server.py gets no static type checking today.	Med-High
pip-audit	The lockfile guarantees integrity but not CVE scanning; pip-audit adds advisory coverage.	Med

---

TypeScript / Node: mux-website

Have: eslint src/ (flat config, typescript-eslint), tsc typecheck,
syntax-parity + docs-snippet checks, production build, Sonar gate. Pre-commit
mirrors it.

Add	Why	Priority
A formatter (Prettier or Biome) with a format:check gate	No formatter config exists; code style is unenforced.	High
Widen ESLint beyond src/	Lint is eslint src/ only; scripts/, tools/, and workers/ are unlinted.	Med
npm audit (or Dependabot) gate	No dependency vulnerability check.	Med
Enable type-aware ESLint rules	Config imports typescript-eslint but does not use the type-checked ruleset (recommendedTypeChecked / projectService), so the strongest rules are off.	Low-Med

---

Grammar / JS tooling: tree-sitter-mux and mux-syntax-highlighting

Have (tree-sitter-mux): canonical matrix drift check, parser regen +
committed-parser staleness check, corpus tests, hook. The parser C is fully
generated (no hand-written scanner.c), so C linting is N/A.
Have (mux-syntax-highlighting): TextMate + editor-support parity checks only.

Add	Why	Priority
Lint + format the hand-written JS (grammar.js, `scripts/*.js	*.mjs`)	Neither repo lints its JS. Biome is a good fit (single binary, no config sprawl). mux-syntax-highlighting has no package.json at all, so this means adding minimal tooling.
Pre-commit hook for mux-syntax-highlighting	It is one of only two code repos with no hook (parity checks run in CI only).	Med

---

Docs: mux-context and mux-examples

Have (mux-context): Sonar scan only. Have (mux-examples): no .github and no
CI at all.

Add	Why	Priority
markdownlint + a link checker (e.g. lychee) on the docs repos	mux-context is the cross-repo knowledge hub; broken cross-repo links are exactly the failure it should catch.	Med
Compile-check every .mux sample in mux-examples	The natural CI for an examples repo: each example must compile/run against the current compiler (a canary). Overlaps with #26 (centralizing samples) - the check belongs wherever the samples land.	Med
llms.txt / link-index integrity check (mux-context)	Ensure the flat agent index does not rot as files move.	Low-Med

---

Suggested phasing (highest leverage first)

1. Rust [lints] table + selective pedantic + rust-toolchain.toml (both Rust
   repos). ~80% of the idiomatic-quality gain, config-only.
2. Python: pyproject.toml + Ruff + mypy (mux-website-api goes from zero to a
   full lint/format/type gate).
3. Supply-chain gates: cargo-deny, npm audit, pip-audit (+ Dependabot).
4. Formatters where missing: Prettier/Biome (website), Biome (grammar repos).
5. Docs + cross-cutting: markdownlint/lychee, actionlint/shellcheck, ASCII gate,
   mux-examples CI.

Each line item is independently shippable as its own small PR. We can pick which
ones are worth it and drop the rest.