chore(quality): add scoped verification workflow

[beruro]

Problem

Repository agents currently choose between repeatedly scanning the full frontend and skipping verification altogether. The existing typecheck command has no duplicate-run protection or exact-state reuse, and there is no guarded quick path that limits lint/tests to the files owned by the current task. Large dirty worktrees can therefore consume unnecessary CPU and can accidentally sweep unrelated user work.

Solution

Add two repository-owned verification entry points:

• pnpm verify:quick -- <exact files...> lints only supported changed files under src/, runs only explicitly supplied src/**/*.test.ts Vitest files, requires an explicit --no-tests decision when changed frontend code has no focused test, and refuses automatic discovery above 80 dirty files.
• pnpm verify:final runs the full TypeScript check once per exact code state. pnpm typecheck now uses this guarded path, while pnpm typecheck:raw remains available for explicit release/debug workflows.

The final-check lifecycle is fingerprint -> cached|lock -> checking -> success-cached|failed, with lock cleanup in finally. The fingerprint includes Git HEAD, changed TypeScript-relevant file contents, Node/platform, and TypeScript version. The cache overwrites one ignored JSON record; CI always bypasses it. AGENTS.md documents the required usage and evidence contract.

Performance guard:

Area	Bound/ownership	Verdict
Quick scope	Explicit task files, or automatic refusal above 80 dirty files	pass
Final concurrency	One per-worktree PID lock; duplicates exit before spawning TypeScript	pass
Cache growth	One overwritten ignored JSON record	pass
Lifecycle	Lock is released in finally; stale dead-PID locks recover	pass
CI	Cache bypassed, so CI always performs the real full check	pass

Potential risks

Local full checks can now be skipped when the exact fingerprint already passed; an omitted fingerprint input would make that unsafe, so the implementation includes source/dependency-relevant files, compiler/runtime identity, platform, and HEAD, while CI never trusts the cache. PID reuse can conservatively block a local duplicate check until the unrelated process exits, but cannot create a false successful result. Quick verification intentionally recognizes the repository-supported *.test.ts surface only; other test shapes still require their direct project command. --no-tests records an explicit decision but cannot mechanically verify the written justification. Rollback is to restore typecheck to the raw tsc command and remove the four tooling files and three added package scripts; no application data or public API changes are involved.

Verification

• pnpm verify:quick -- AGENTS.md package.json scripts/quality/verification-policy.mjs scripts/quality/verification-policy.test.mjs scripts/quality/verify-changed.mjs scripts/quality/verify-final.mjs — passed; correctly skipped frontend lint/tests for a tooling-and-documentation-only scope.
• node --test scripts/quality/verification-policy.test.mjs — passed 4/4 tests covering fingerprint invalidation, file-scope rules, one-record cache replacement, duplicate locking, and stale-lock recovery.
• pnpm verify:final — executed the real full TypeScript check for the committed branch state and passed; no cache result was reused.
• Post-check inspection confirmed the lock was removed and the ignored cache contained one schema-v1 record with a SHA-256 fingerprint.
• git diff --check origin/develop...HEAD — passed.

No screenshot is useful because this change has no user-visible UI.