[eslint] strict-codegen: add ultra-strict rules to the universal lint overlay, with repo-wide bulk suppressions

[Sean Larkin (TheLarkInn)]

Summary

Newly generated packages (e.g. the upcoming rushd wire-layer packages) need an ultra-strict lint rule set, and we want it enforced repo-wide rather than as an opt-in mixin. This PR adds the "strict-codegen" rules to the repo's universal ESLint overlay (localCommonConfig in rigs/decoupled-local-node-rig/.../flat/profile/_common.js), which every project composes after the published @rushstack/eslint-config profile, and records all pre-existing violations with @rushstack/eslint-bulk so the ratchet can flip to 'error' without breaking builds.

Also adds a root AGENTS.md lint policy and a "Lint Policy" section in .github/copilot-instructions.md: no new inline eslint-disable comments, no ignores-entry additions to hide violations, and .eslint-bulk-suppressions.json (managed only via the eslint-bulk CLI) as the sole sanctioned suppression mechanism; the file may only shrink in a PR except in dedicated onboarding PRs.

Details

Rule set (all rules already ship with the repo's ESLint toolchain; no new plugins): complexity budget (complexity: 3, max-depth: 3, max-lines-per-function: 30, max-lines: 100, max-params: 4), @typescript-eslint/no-magic-numbers (enums/readonly class props exempt), @typescript-eslint/prefer-nullish-coalescing (all exemptions disabled), sort-imports member sorting, import/order with alphabetization + full grouping (merged with the existing @{rushstack,microsoft}/** pathGroups convention), import/enforce-node-protocol-usage, @typescript-eslint/consistent-type-imports (keeps the inline-type-imports fixStyle house style), import/no-relative-parent-imports (test files exempt per repo convention), and @typescript-eslint/no-implied-eval replacing the core rule to avoid double-reporting.

Rollout strategy (why 'warn' first): the universal overlay is all-or-nothing, and bulk suppressions can only be captured for rules that are enabled. So the rules land at 'warn' with // strict-codegen: ratchet to 'error' markers, every package's existing violations are captured into per-package .eslint-bulk-suppressions.json files (6,510 suppressions across 114 packages), and a follow-up PR flips the severities to 'error' (a ~15-line diff; suppressions are severity-independent, so builds stay green). A later phase strips the remaining inline eslint-disable comments repo-wide and then enables noInlineConfig + reportUnusedDisableDirectives: 'error' in the overlay.

Commits are sharded for review: hand-written changes (overlay rules, docs, config wiring, 7 package.json devDep fixes, 2 stale inline-disable removals) are separate from the 10 per-folder machine-generated suppression commits; review the file lists, not the JSON.

Notable execution findings:

• Suppression capture must run on a built repo: eslint-plugin-import rules silently skip imports that don't resolve yet (e.g. apps/lockfile-explorer's generated build/lfx-shared).
• @rushstack/eslint-bulk requires eslint to be a declared dependency of the target project; 7 projects that linted via their rig without declaring it were fixed (plus lockfile).
• 10 legacy .eslintrc.js-only test projects (eslint 7/8 matrix fixtures) are unaffected - the universal overlay is flat-config only. build-tests-subspace/typescript-v4-test consumes the published profile directly and is intentionally excluded.
• build-tests/eslint-bulk-suppressions-test-flat self-regenerates its versioned fixture; the strict rules legitimately added one entry to it.
• Two inline import/order disables (in apps/rush, heft-webpack4-plugin) became unused once bulk suppressions covered them and were removed.

Backwards compatibility: no published package's shipped code changes; all version-bump change files are type: "none". The overlay change itself is in a private rig package.

How it was tested

• Full-repo rush build (192 projects) on the final commit: exit 0, zero lint warnings or errors.
• Smoke-tested the composed config (published profile + overlay) against sample files with eslint@9.37 / typescript-eslint (@typescript-eslint)@8.56.1: strict rules fire at 'warn', no-eval/no-implied-eval override behaves, no plugin-redefinition conflicts, and a compliant file passes clean.
• Per-project verification pass: eslint src --max-warnings 0 across all 141 wired config folders comes back clean (excluding the self-testing eslint-bulk fixture folders, whose own build passes).
• eslint-bulk suppress + rebuild piloted end-to-end on libraries/tree-pattern before mass rollout.

Impacted documentation

N/A for the website. Repo-local docs added: AGENTS.md (new lint policy + rollout phases) and .github/copilot-instructions.md (new section 7 referencing it).