`npm run lint` is unrunnable: script is `eslint src/` but eslint is not a devDependency

[yakimoto]

Symptom

npm run lint in this repo is unrunnable. The script is defined as eslint src/, but eslint is
not a devDependency and there is no eslint config. Every invocation dies before it lints anything:

$ npm run lint
sh: eslint: command not found
# exit 127

The repo therefore advertises a lint gate it does not have. Anyone (human or agent) who runs the
documented command gets a shell error, not a lint result — and any workflow that shelled out to it
was failing for a reason unrelated to code quality.

Repro / Evidence

• Reproduced on main and on PRs fix(security): resolve 4 CodeQL alerts and disable npm cache on untrusted-ref release jobs #62 and fix(security): put the prototype-key guard inline at the write site (closes CodeQL alert #2) #64 (2026-09-06 / 2026-09-07): sh: eslint: command not found.
• _release-verify.yml already had its Lint step removed after release run
  33826226004 failed with exit 127 — i.e. the workflow was patched around the broken script
  rather than the script being fixed. That removal is the receipt that this has already cost a red
  release run.
• grep -n '"lint"' package.json shows the script; grep -n eslint package.json shows no
  devDependencies entry; there is no eslint.config.* / .eslintrc* at the repo root.

The dangerous residue is that the script and its README/workflow references still exist, so the
repo looks linted. Absence is being rendered as health.

The right shape of fix

Pick one and make it true end to end — do not leave a third state where the script exists but no
gate runs it:

(A) Make it real. Add eslint (+ the parser/config the repo actually needs, e.g.
typescript-eslint for src/) as devDependencies, commit a config, fix or explicitly baseline the
findings, and wire the Lint step back into CI so npm run lint is a gate that can go red.

(B) Remove it. Delete the lint script from package.json, and remove every README and
workflow reference to it, so nothing claims a lint gate exists.

(A) is preferred; (B) is acceptable and honest. Silently leaving it broken is neither.

Done-check

• npm ci && npm run lint exits 0 in CI on a clean checkout, and the Lint step is present and
  required in the release/verify workflow — or —
• npm run lint no longer exists, and grep -rn "npm run lint\|run: .*lint" README.md .github/ in
  this repo returns no references to it.
• Either way: no workflow contains a lint step that was removed to work around exit 127.