Add a regression test for the oxlint gate

A gate that checks nothing exits 0, which is indistinguishable from a
clean run — that is why the two invocation bugs fixed in 91f46ff went
unnoticed across 49 commits.

The check runs the configured oxlint command with one rule forced to
warn and requires a non-zero exit. That single probe covers a missing
--deny-warnings, a command that discovers no files, a broken tsconfig
path, and an upstream flag rename. Two things the probe cannot see get
their own assertions: that every gate invokes `pnpm oxlint` with nothing
appended, and that --type-aware is still enabled, since the canary rule
is not type-aware.

Verified against four reconstructed states: the b6ee4c8 and 9b0cb38
configurations, --type-aware removed, and a tsconfig path that matches
no files. Each fails; the current configuration passes.

Follows the existing check-layer-boundaries.mjs pattern — an exported
function driven by a Vitest case.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/domain/src/__tests__/lint-gate.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+import { checkLintGate } from "../../../../scripts/check-lint-gate.mjs";
+
+describe("lint gate", () => {
+	it("fails on warnings instead of silently passing", () => {
+		const violations = checkLintGate();
+		if (violations.length > 0) {
+			throw new Error(
+				`Lint gate integrity violations:\n  ${violations.join("\n  ")}`,
+			);
+		}
+		expect(violations).toHaveLength(0);
+	});
+});