EPIC: bring Hermuz onto the house toolchain baseline

Tracking issue. `Hermuz` has drifted behind the toolchain the other personal monorepos converged on — it is not a deliberate variant, just an earlier generation.

## Where it stands

| | Hermuz | house standard |
|---|---|---|
| Workspace layout | `packages/*` + `apps/*` ✅ | same |
| Runtime / PM | Bun ✅ | same |
| Lint | ESLint 9 (`config/eslint.js`) | Biome |
| Format | Prettier | Biome (same tool) |
| Git hooks | none | Lefthook |
| Dead code | none | knip |
| Version catalog | none | Bun `catalog:` |
| TypeScript | `^5.8.3` | `7.0.2` |
| Shared tsconfig | `tsconfig.base.json` ✅ | same |
| CI | one `ci:` job | filter → fan-out → `CI Success` gate |

The bones are right — Bun, the two-directory workspace split, a shared base tsconfig. It is the quality-gate layer that is missing.

## Gaps beyond tooling

Two things stand out reading the root `package.json`:

- **No `test` script and no `typecheck` script at the root.** Scripts are limited to `db:generate`, `db:migrate`, `lint` and `format`. There is a `run_tests.sh` at the repo root that is not wired into anything.
- **`remove-comments.js` sits at the repo root** with no reference from any script. Worth deleting or explaining.

Adding a root `typecheck` and `test` is a prerequisite for most of the rest, since CI and pre-push hooks have nothing to call otherwise.

## Suggested order

1. **Root `typecheck` and `test` scripts** fanning out with `bun run --filter '*'`, plus folding `run_tests.sh` into them or removing it
2. **ESLint + Prettier → Biome** — one mechanical reformat commit, separate from behavioural change
3. **CI: fan out and add the `CI Success` aggregate gate**, then make it the required check for `main`
4. **Lefthook** — staged-only Biome on pre-commit, typecheck + test on pre-push
5. **knip**
6. **Bun catalog** for shared versions (`typescript`, `@types/node`, `drizzle`, `discord.js`)
7. **TypeScript 5.8 → 7**

Step 7 is last deliberately — it is the one most likely to surface real errors, and it is much easier to land once CI is actually running.

## Worth confirming first

This repo has had less recent activity than the others. If it is dormant, the right scope may be just steps 1–3 (so CI catches regressions if work resumes) and closing the rest. Worth deciding before anyone starts on step 7.