EPIC: bring vellum onto the house toolchain baseline

Tracking issue. `vellum` has drifted behind the toolchain the other personal projects converged on — it is not a deliberate variant, just an earlier generation.

## Where it stands

| | vellum | house standard |
|---|---|---|
| Lint | ESLint 9 + `typescript-eslint` | Biome |
| Format | Prettier | Biome (same tool) |
| Git hooks | `simple-git-hooks` + `lint-staged` | Lefthook |
| Dead code | — | knip |
| TypeScript | `^6.0.3` | `7.0.2` |
| CI | **none** | filter → fan-out → `CI Success` aggregate gate |
| Test runner | vitest | `bun:test` (3 of 4 repos) |

Note this is a **single-package app**, not a monorepo, so the workspace/catalog half of the standard does not apply. The tooling and CI half does.

## The one that actually matters

**There is no CI.** `.github/workflows/` contains only `pages.yml`, which deploys to GitHub Pages on push. Nothing runs lint, typecheck, or tests on a pull request.

The repo has a real test suite (`vitest run --coverage`, with Testing Library and jsdom) and a real `check` script that chains lint, format and typecheck — none of it is enforced anywhere except a local pre-commit hook, which `--no-verify` bypasses. That is the gap worth closing first, and it is worth closing independently of every other item here.

## Suggested order

1. **Add CI** — a workflow running the existing `bun run check` and `bun run test`, ending in an aggregate `CI Success` job, made the required status check. Uses what already exists; no tooling change needed.
2. **ESLint + Prettier → Biome** — one mechanical reformat commit, kept separate from behavioural changes.
3. **`simple-git-hooks` → Lefthook** — two-tier shape: staged-only Biome on pre-commit, typecheck + test on pre-push.
4. **Add knip.**
5. **TypeScript 6 → 7.**

Steps 2–5 are each small enough to be one PR. Step 1 should not wait on any of them.

## Worth deciding rather than assuming

The repo tests with **vitest**, and it depends on `@randsum/daggerheart`, so it sits in the RANDSUM orbit where `bun:test` is standard. Migrating the runner is a real change with real risk (jsdom setup, Testing Library integration, coverage reporting) and it is not obviously worth it for a working suite. Reasonable to leave vitest in place and note the exception — the standard is a default, not a mandate.

Start with .github/workflows/ and the existing package scripts behind `bun run check` and `bun run test`; review `pages.yml` without changing its deployment behavior. Add the pull-request CI and aggregate `CI Success` gate using the existing checks, then verify the workflow passes.

索引モデルが issue の本文から書いたものです。