fix: restore executable and trustworthy CI quality gates

[akinolavictor419-sketch]

Summary

Resolves #94. Several quality gates referenced by our workflows and README either did not exist, could silently pass, or could not run at all. This PR restores them so CI is an accurate, trustworthy signal.

Changes

• package.json: add the missing test:mutation (stryker run) and sync:check (node scripts/check-cross-repo-sync.mjs) scripts. The mutation workflow and the sync script's own header referenced them, but they did not exist.
• .github/workflows/ci.yml: make format:check authoritative. Previously npm run format:check || npm run format ran Prettier in write mode as a fallback, masking formatting failures (the repo had 109 unformatted files). Also run the size gate in the main job, matching what the README documents.
• .github/workflows/cross-repo-sync.yml: invoke the gate via npm run sync:check instead of a raw node call.
• scripts/bundle-size.mjs: raise the full-barrel budget 14 KB -> 16 KB with justification. The current barrel measures ~15.0 KB minified after the batch/provenance decorator surface was added; 14 KB predates that surface.
• src/BatchRiskOracle.ts: document the 7 symbols flagged by docs:check (BatchRiskOracle.getScores, BatchRiskOracleOptions, BatchRiskOracleOptions.logger, BatchItemResult.destination, BatchItemResult.status, BatchItemStatus, BatchResult) so the docs gate passes without warnings.
• stryker.config.json / vitest.mutation.config.ts (new): the Stryker vitest-runner forces the threads pool, which cannot combine with the main vitest config's execArgv: ['--expose-gc'] (worker_threads + V8 flags hangs the run). The dedicated config uses the threads pool, a single thread, and excludes tests/benchmarks/**, making the mutation gate runnable on every platform.
• README.md: reflect the actual CI gates (size/docs/supply-chain), the full scripts tree, and correct the bundle-size table (~9.6 KB / ~15.0 KB, < 4 KB gzipped).

Verification

All gates pass locally on Windows (node 24):

• typecheck, lint, format:check (whole repo), test (217 tests), build, size, docs:check, docs
• test:mutation (Stryker; initial run of 211 tests plus a full mutation run)
• sync:check (reports the expected drift below)
• sbom, license-check, npm audit --audit-level=high (0 vulnerabilities)

Notes / follow-ups

• sync:check exits non-zero because of pre-existing contract drift: the grydlock-extension stand-in for RiskOracle.getScore adds an options?: { timeoutMs?, signal?, bypassCache? } parameter not present in this adapter's canonical (destination: string) => Promise<number>. That drift originates in grydlock-extension and is out of scope here; once it lands there, this gate will pass. Worth tracking separately.
• test:mutation and sync:check run on schedule / workflow_dispatch (and, for sync, on matching paths) — not on every PR. They are now runnable and trustworthy wherever they are triggered.

Closes #94

[knytcomics-ui]

Please update the exported RiskOracle stand‑in in the grydlock-extension repo so its public getScore signature exactly matches the canonical interface in grydlock-oracle-adapter:

getScore(destination: string): Promise

This fixes the cross-repo drift reported by workflow job 95642622872 (drift-report.md).

What to change

File: the adapter stand-in file in grydlock-extension that currently exports/declares RiskOracle.
Change the exported interface/type so getScore takes a single argument (destination) and returns Promise.
You may keep optional internal parameters on the concrete implementation method, but the exported type must be the single-argument signature.
Before (problematic)

ts
export interface RiskOracle {
getScore(destination: string, options?: { timeoutMs?: number; signal?: AbortSignal; bypassCache?: boolean }): Promise;
}
After (required)

ts
export interface RiskOracle {
getScore(destination: string): Promise;
}
Allowed implementation pattern

ts
export class AdapterOracle implements RiskOracle {
// implementation may accept options internally as optional params
async getScore(destination: string, options?: { timeoutMs?: number; signal?: AbortSignal; bypassCache?: boolean }): Promise {
// use options internally
return 42;
}
}
Tests & validation (what to run)

Run type checks and unit tests in the adapter repo.
Run the cross-repo sync script from grydlock-oracle-adapter to confirm the drift is resolved: node scripts/check-cross-repo-sync.mjs
Verify drift-report.md no longer reports RiskOracle.getScore as out of sync.
Commit / PR guidance

Branch name: fix/riskoracle-getscore-signature
Commit message: Match RiskOracle.getScore signature to canonical interface (single param)
PR title: Fix: Match RiskOracle.getScore signature to canonical interface
PR description should reference the failing job and drift file:
“Fixes cross‑repo drift reported in job 95642622872. Drift report: drift-report.md. Makes exported RiskOracle.getScore signature match grydlock-oracle-adapter canonical interface (single parameter).”

[knytcomics-ui]

this is a suggested fix to the failing test