fix(ci): make the lint command a read-only check

[ttbombadil]

Summary

Make the shared npm run lint command a read-only check by removing --fix. CI invokes this script; fixable errors previously passed after changing the checkout. Keep developer lint-staged autofixing.

Verification

• Behavioral regression runs the actual script in a unique temporary ESLint fixture: fixable error must exit 1 and leave source unchanged. RED (old command exited 0) → GREEN.
• Independent read-only review: no blocking findings.
• Full unit/coverage, types, docs, lint, build and Sonar gates.
• Real toolchain and Docker integration; full Chromium E2E using temporary port3307 adapter because an unrelated local project owns3000.
• Normal commit/push hooks, no bypass.

Base: freshly fetched e92f5b466ec61cdf4ada1d78e901ac868885065e, after green post-merge CI for #188. No runtime, Provider, SSOT/ADR or Tutor-semantic changes; protected/untracked user files untouched.