Size and complexity rules give agent-written code a computational sensor

## Summary

Turn on ESLint's `complexity`, `max-lines`, `max-lines-per-function`, `max-params`, and `max-depth`, so the shape failures agent-written code reaches for are caught by a sensor rather than by reading the diff.

## Motivation

The repo runs sensors for syntax, formatting, prose, links, and types. None of them measures shape. `eslint.config.js` sets no size or complexity rule today, so a four-hundred-line component or a nine-argument helper passes every check that exists.

That gap costs more now that most code here arrives from an agent. The failure modes static analysis catches cheapest in agent-written code are a short, mechanical list — argument count, file length, function length, cyclomatic complexity — and reading for them by hand is the expensive way to find them.

#189 records the taxonomy (computational vs inferential, fast vs slow) as a post idea. This is the computational, fast half of that taxonomy, applied to this repo.

## Scope

- Add the rules to `eslint.config.js`.
- Decide how the AstroPaper upstream files are treated. `src/components/`, `src/layouts/`, `src/pages/`, `src/styles/`, `src/utils/`, and `src/content.config.ts` are theme code; grading them produces findings nobody will act on.
- Set thresholds from the current corpus rather than from ESLint's defaults. Measure first, pick a number the tree already passes, then ratchet — a rule that lands red is a rule that gets disabled.
- Decide the level. `error` blocks; `warn` measures. #421's rule — every convention gets an owning sensor or a filed gap — argues for `error` once a threshold is calibrated.

## Acceptance criteria

- [ ] `eslint.config.js` sets `complexity`, `max-lines`, `max-lines-per-function`, `max-params`, and `max-depth`.
- [ ] `pre-commit run --all-files` passes on the current tree at the chosen thresholds.
- [ ] Each threshold's value is justified by a measurement of the existing corpus, not by a default.
- [ ] Upstream AstroPaper files are either scoped out or pass unchanged.

## Additional context

The convention generalises past this repo — `collection-json.hs#173` is evaluating hlint's `smell` directives for function length and arity on the Haskell side. Landing it here first gives the others a calibrated example rather than a guess.

Source: a Readwise highlight on maintainability sensors for coding agents, which enumerates exactly this list as the low-hanging fruit for static analysis.