Setup Quality Gates

Install the caps a reviewer would otherwise count by hand as build failures, then write the one page of prose that is left. Two rules bind every step:

• Every gate is error. A warn is a violation with standing permission. A cap the repo can't meet yet is ratcheted (§5), never downgraded.
• Resolve rule names against the installed tool, never from memory. Linters rename, promote and retire rules between minor versions.

1. Detect the toolchain