Fix oxlint gate invocations that silently linted nothing

Two separate defects, both of which made the gate pass without checking:

lefthook ran `pnpm oxlint -- --deny warnings`. pnpm forwards arguments
after `--` to the script, so oxlint received its own `--` terminator and
read the rest as file paths — the pre-commit oxlint job linted 0 files.

The check script used `--deny warnings` rather than `--deny-warnings`.
`--deny` takes a rule or category and `warnings` is neither, so it was
accepted and ignored. Without `--deny-warnings` the run reports warnings
but still exits 0, so CI was equally non-blocking.

Both now call `pnpm oxlint`, keeping the flags in one place.

Introduced 2026-03-29 in b6ee4c8, which claimed warnings would fail the
build. 9b0cb38 diagnosed the invalid flag but fixed only the npm script,
leaving both actual gates broken.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

lefthook.yml

@@ -24,6 +24,6 @@ pre-commit:
           - name: typecheck
             run: pnpm exec tsc --build
           - name: oxlint
-            run: pnpm oxlint -- --deny warnings
+            run: pnpm oxlint
           - name: test
             run: pnpm vitest run --reporter=dot --coverage.reporter=text-summary

package.json

@@ -29,6 +29,6 @@
 		"check:ignores": "node scripts/check-lint-ignores.mjs",
 		"check:classnames": "node scripts/check-cn-classnames.mjs",
 		"check:props": "node scripts/check-component-props.mjs",
-		"check": "pnpm audit --audit-level=high && knip && biome check . && node scripts/check-lint-ignores.mjs && node scripts/check-cn-classnames.mjs && node scripts/check-component-props.mjs && jscpd && pnpm jsinspect && tsc --build && oxlint --tsconfig tsconfig.json --type-aware --deny warnings && vitest run"
+		"check": "pnpm audit --audit-level=high && knip && biome check . && node scripts/check-lint-ignores.mjs && node scripts/check-cn-classnames.mjs && node scripts/check-component-props.mjs && jscpd && pnpm jsinspect && tsc --build && pnpm oxlint && vitest run"
 	}
 }