#1263 Retire the deferred-lint mechanism and adopt toolbelt.errors in agents

[williamthorsen]

What

Fixes all outstanding lint issues and removes the cap that downgraded the severity of associated rules during strict-lint runs. Error reporting in the agents package is improved to include the underlying cause. Directory and file names with special dollar-sign sequences are now handled safely during deployment.

Why

Ten rules sat at warn in agents, where they blocked no gate and went unfixed long enough that one of them had been flagging a live defect the whole time. agents held the repository's last deferral, so clearing it is the difference between a mechanism sitting there for the next package to reach for and no mechanism at all. Errors thrown across the package discarded the failures they wrapped, leaving diagnostics that named a symptom without its cause.

Details

🎉 Features

• Every site that folds a caught failure into a new error attaches it as cause. Nine compose through chainError; two that deliberately discard the caught message take a bare cause, and assertFilledAnchorsResolve keeps its own composition, which places the cause on its own line after a multi-clause explanation.

🐛 Bug fixes

• rewriteTemplateVariables passes replacer functions to replaceAll, so a harness home directory or identifier containing $$, $&, $`, or $' is inserted literally instead of expanding against the match it was meant to replace.

♻️ Refactoring

• describeError from @williamthorsen/toolbelt.errors/candidate replaces the inline error instanceof Error ? error.message : String(error) at every site in agents, and the two locally defined copies in content-validation.ts and guidance-hooks.ts are gone. bin/codeassembly.js keeps its inline form so its top-level imports stay resolvable without an install, which is what lets it report a missing build.
• Twenty warnings across eight unicorn rules are cleared with no rule suppressed inline. The three no-incorrect-template-string-interpolation reports were false positives over CodeAssembly's own {token} syntax, so each site moves the token out of the template literal rather than silencing the rule.
• Five best-effort .catch(() => {}) cleanups in kb-edit/commit-supersede.ts collapse into an unlinkQuietly helper that carries the rationale for swallowing once instead of five times.
• packages/agents/.config/ is deleted, along with the eslint.config.ts rule block and the tsconfig.json include that reached it. The root's advisory ceilings apply by cascade.
• The remaining .js import specifiers in .ts source are rewritten to .ts, across agents and the root scripts/ suite.

🧪 Tests

• A guard at the repository root enumerates packages/* and fails when one declares a deferred-rule list or sets maxSeverity in its own strict-lint.config.ts. It checks both halves because either alone restores the mechanism, and it covers a package added later without anyone remembering to add it.
• Every production site that gains a cause gains an assertion on it: path-rewriter, branch-helpers, read-preferences, recall, and rulebook-deploy.
• The template-variable suite round-trips $&, $$, and $' through both substitution parameters, so a revert to string replacement fails on either.

📦 Dependencies

• @williamthorsen/toolbelt.errors 0.2.0, the same adoption kb made for its own loader errors.

Closes #1263

[github-actions]

Dependency audit

Production dependency audit passed.