Lint gate excludes genie/ and root .genie.ts, so 'zero warnings repo-wide' is narrower than documented

Problem

The lint gate covers packages, scripts and context (devenv.nix, taskModules.lint-oxc lintPaths). It does not cover genie/ or repo-root *.genie.ts files.

Those are real first-party TypeScript sources — the generators that produce package.json, tsconfig, CI workflows and the dependency catalog. They are arguably higher-leverage than most linted code, since a defect there propagates into every generated file.

Evidence

Running oxlint directly over the uncovered files on a clean tree reports 11 errors and 1 warning:

• pnpm-install-contract.json.genie.ts
• genie/tsconfig-projects.ts
• genie/ci-workflow/support-files.ts
• genie/ci-workflow/setup.ts
• genie/otel-scrape-registry.ts
• genie/ci-scripts/bundle-smoke.ts

Example: overeng(named-args): function 'pnpmStateCachePrimaryKey' has 2 parameters. Consider using named arguments (genie/ci-workflow/setup.ts:587).

These are pre-existing and unrelated to any current work — they reproduce on a tree that touches none of those files.

Why it matters

The gate config carries this comment:

Warning cleanup is complete: every oxlint rule is at zero repo-wide (swept + key rules promoted to error…). Lint is now fatal on ANY warning so the gate can never silently regress.

"Zero repo-wide" is true only for the three covered paths. genie/ has never been swept, so the stated invariant is narrower than it reads. Anyone trusting that comment would reasonably believe the whole repo is clean.

The practical cost is confusion: a contributor running bare oxlint sees 11 errors and reasonably concludes the branch is broken, then either burns time investigating or "fixes" unrelated files inside an unrelated PR.

Proposed direction

Decide deliberately, then make the config say what is true:

• Either extend lintPaths to include genie/ and root *.genie.ts, and burn down the 11 errors as a standalone cleanup;
• or keep the scope as-is and correct the comment to state which paths the zero-warning invariant actually covers.

The first is preferable — generators deserve at least the lint standard of the code they generate — but the second is far better than the current silent mismatch.

Acceptance

• lint scope and the documented invariant agree
• if scope is extended, the 11 pre-existing errors are cleared
• a bare oxlint run and the lint:check gate agree on whether the tree is clean

Start with devenv.nix and taskModules.lint-oxc, especially lintPaths, then inspect the listed root and genie TypeScript files. Run oxlint on the uncovered files and compare it with the lint:check gate. Done means the lint scope matches its documented invariant, the reported errors are addressed if scope expands, and bare oxlint agrees with the gate.