Publish Effection policy rules through `@effectionx/lint`

Parent Quest: #254

Story

As an effectionx policy author, I want mechanically enforceable Effection policies published as Oxlint rules, so contributors receive precise failures before an AI review and other projects can apply the same checks.

An effectionx project enables the plugin and selects a rule by its stable identifier, such as:

{
  "jsPlugins": ["@effectionx/lint"],
  "rules": {
    "effectionx/no-yield-in-finally": "error"
  }
}

Current gap

The Async Teardown and Scope-Bound Event Registration policies describe patterns that static analysis can detect, but effectionx has no published lint package. Prototype rules outside this repository are not owned, versioned, or verified with the policies they enforce.

Contract

Publish an @effectionx/lint package that exposes an Oxlint JavaScript plugin with stable rule identifiers and diagnostics.

The first rule set is limited to policies already owned by effectionx:

• effectionx/no-yield-in-finally enforces the Async Teardown policy.
• effectionx/require-scope-bound-event-registration enforces the Scope-Bound Event Registration policy.

Each rule:

• identifies the policy it enforces;
• reports the smallest useful source span with a stable message;
• distinguishes violations from documented compliant and intentional patterns;
• has positive, negative, and edge-case fixtures;
• uses only APIs supported by the pinned Oxlint JavaScript-plugin implementation; and
• is exported through the package’s public plugin entrypoint.

The root repository consumes the workspace package through its Oxlint configuration. The published package follows the repository’s standard package structure and metadata policies.

Oxlint’s supported scope analysis may be used. A policy that requires unavailable type information remains AI-validated until the plugin API can enforce it reliably; it must not be approximated with a knowingly weaker rule.

Acceptance

• Consumers can install @effectionx/lint, load it as an Oxlint JavaScript plugin, and enable either initial rule by its documented identifier.
• Each rule reports every known violating fixture and accepts its corresponding compliant fixture.
• no-yield-in-finally distinguishes asynchronous yield* teardown from synchronous cleanup that may remain in finally.
• require-scope-bound-event-registration distinguishes scope-owned registration and teardown from listeners whose lifetime depends only on an event firing.
• The effectionx root lint command runs the published workspace plugin and fails on a deliberate violation.
• Diagnostics and exit status are stable across repeated runs with unchanged inputs and pinned tools.
• Package build, typecheck, tests, lint, formatting, and publication checks pass.

Evidence

Rule fixtures provide at least one mutation control per rule: removing the prohibited construct makes the diagnostic disappear without disabling the rule. Root integration demonstrates that the package is resolved through the same configuration consumers use.

Verification includes:

pnpm lint
pnpm check
pnpm build
pnpm test

Dependencies

• Depends on #255 for the repository’s Oxlint host.
• Blocks executable lint-backed policy entrypoints in #254.

Out of scope

• Deno lint compatibility
• Policies not already documented in effectionx
• Type-aware custom rules unsupported by Oxlint’s JavaScript-plugin API
• XMD orchestration and historical pull-request replay

Start with dependency #255 and the repository's Oxlint host, then inspect the workspace package structure and public plugin entrypoint. Read the Async Teardown and Scope-Bound Event Registration policies before reviewing the rule fixtures and root Oxlint configuration. Done means both rules are exported, their positive, negative, and edge-case fixtures pass, root integration works, and pnpm lint, check, build, and test succeed.