fix(ci): replace markdownlint-cli2 with markdownlint-cli, drop the shim - #471

[email protected] pulls a vulnerable braces path through
micromatch/globby (CVE-2026-93687, no patched release available), which
was failing `npm audit --audit-level=moderate` in CI for every PR and
on main itself.

A prior approach (now superseded) kept markdownlint-cli2 as the command
surface via a local bin-shim package plus a hand-rolled recursive file
walker reimplementing globby's glob matching. That walker was verified
correct for this repo's current **/*.md glob, but reimplementing glob
matching by hand is exactly the kind of code most likely to drift from
the real tool's behavior on edge cases (symlinked directories, nested
wildcards, etc.) without anyone noticing until something silently stops
being linted.

This replaces markdownlint-cli2 entirely with [email protected],
which has zero vulnerable transitive dependencies (confirmed via a
fresh `npm ci && npm audit`) and takes globs/ignores directly as CLI
arguments, resolved by its own tinyglobby glob engine rather than any
custom code of ours.

Changes:
- .github/linters/package.json: markdownlint-cli2 -> markdownlint-cli,
  with a js-yaml override to clear markdownlint-cli's own single
  moderate transitive CVE (GHSA-r3ph-w7gj-g6xm).
- .markdownlint-cli2.yaml -> .markdownlint.yaml: markdownlint-cli
  auto-discovers this filename directly, no --config flag needed. Only
  the rule-config block and frontMatter regex carry over; globs/ignores
  are not a markdownlint-cli config concept.
- .github/linters/run-markdownlint.mjs: a ~50-line script holding the
  glob/ignore list once, shared by CI and the pre-commit hook (same
  single-source-of-truth guarantee the old globs: key gave us).
  Supports --fix passthrough and --count-only (prints the matched file
  count via the same tinyglobby engine, for CI's "did this actually
  lint anything" guard, replacing the old `Linting: N file(s)` stdout
  scrape).
- ci.yml / .pre-commit-config.yaml: both now call
  `node .github/linters/run-markdownlint.mjs` instead of
  `npx markdownlint-cli2`.

Verification:
- npm ci && npm audit --audit-level=moderate: 0 vulnerabilities.
- node .github/linters/run-markdownlint.mjs --count-only: 190, an exact
  match to the real [email protected] binary's own reported
  count on the pre-existing **/*.md glob (verified directly against the
  real tool, not a reimplementation, before trusting this number).
- node .github/linters/run-markdownlint.mjs: clean exit 0 against the
  current repo content, matching main's current passing state.
- pre-commit run markdownlint --hook-stage manual (fix) and
  markdownlint-check --hook-stage manual --all-files (check-only): both
  pass.
- make validate: all validators pass.

Supersedes the markdownlint-cli2 shim approach on this same branch.

Co-authored-by: OpenCode Agent <[email protected]>