fix(cli): launch Biome reliably in the Windows architecture guards - #1000

On the Windows runner the Biome guards failed with `expected [] to include
'src/kernel/exit.ts:plugin'` and two more like it: spawning
`node_modules/.bin/biome` directly found no executable there, and the empty
output read as a tree with no findings.

The guards now run the package's own launcher, `@biomejs/biome/bin/biome`,
through `process.execPath`, which works on every platform. A run that is
neither clean (exit 0) nor diagnosed (exit 1 with a finding) throws instead of
returning nothing, so a guard asserting that no finding exists can no longer
pass when Biome never ran. A test with a missing launcher was red before this.

Closes #881

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z

With Biome launched, the Windows guards still failed with `expected [ …(5) ]
to include 'src/kernel/exit.ts:plugin'`. Biome found the five planted findings
it finds elsewhere, but names a file with backslashes there, so no key
matched. The parser now turns the separators into forward slashes, under a
test fed a Windows line.

Refs #881

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z

A CI step name, an error message and a test comment carried the number of the
issue that led to them. Each now says what it checks, and the issue numbers
stay in the commits and pull requests that fixed them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z

The documentation rule already dropped ticket and run IDs, but only for the
Markdown its paths name, so code, comments, test names and CI steps carried
them. A rule with no paths now covers every file: tracker IDs live in commits,
pull requests and issues, and the thing is named by what it does. The
documentation rule no longer repeats the clause.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z

The Windows job ran one file of the architecture suite, the Biome guards.
It now runs `pnpm test:arch`, the same suite the Linux architecture job runs,
so every architecture guard is exercised on Windows, the Biome guards among
them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z

The rule now reads as a single bullet, and the documentation rule keeps its own
clause unchanged: its paths only reach the documentation, so the two do not
overlap.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z

Run on Windows, the architecture suite failed in three files that read text by
its lines: `codebase-map.md has no fenced block`, `expected [] to include
'knip'`, and a SyntaxError loading `mutation-covers-source`. A Windows checkout
turns LF into CRLF, which the repository's scripts and tests do not expect.

`.gitattributes` now asks for LF on every platform, `text=auto` leaving binary
files alone. No committed file changes: the only CRLF files are archived
evidence whose own `.gitattributes` already mark them `-text`.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z

#912 upgraded Biome and already maps each reported file relative to the planted
tree with the platform separator, so its mapping replaces this branch's
backslash parser and that parser's test. This branch keeps the node launcher
and the failure when Biome never ran.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z

After the merge with #912, the Windows guards still failed with
`expected [ …(5) ] to include 'src/kernel/exit.ts:plugin'`: Biome found the
five planted findings, and none of their paths matched. Only the planted tree
went through realpathSync, so a file Biome named through another spelling of
the same directory could not be made relative to it. Each file now resolves
through realpathSync too, and a failed match prints the findings it saw.

Refs #881

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z

With the findings now printed, the Windows guards failed on
`ENOENT ... lstat '...\aidd-biome-bite-BHHWDT\C%3A'`. On Windows Biome reports
an absolute file, and the GitHub reporter escapes its drive colon as `%3A`,
so the path resolved under the planted tree instead of to the file. The guard
decodes the reporter's `%3A`, `%2C` and `%25` before resolving the path, under
a test that was red first.

Refs #881

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z