chore: add mise toolchain, agent docs, and CI hardening

[dpsiderius]

Brings the project scaffolding up to standard so both humans and agents have a single, verifiable entry point. No runtime behaviour changes — nothing here touches the plotting path.

Toolchain

Adds .mise.toml as the single source of truth:

• Node pinned to 22.20.0 — the exact version packaging/assemble.sh bundles into the .deb. CI was testing on Node 20, so it was not testing the runtime that ships to the Pi.
• zizmor and actionlint pinned, so the workflow audits are runnable locally.
• 13 tasks delegating to the existing npm scripts, plus ci and ci-watch.

⚠️ Node is now pinned in two places — .mise.toml and packaging/assemble.sh. Bump both together.

CI

• The gate runs through mise run ci, so local and CI cannot drift.
• Adds least-privilege permissions: contents: read, a cancel-in-progress concurrency group, workflow_dispatch, and persist-credentials: false.
• Adds a zizmor job auditing the workflows on every run.
• release.yml: sets persist-credentials: false. Nothing there pushes with git (the release upload authenticates with an explicit GH_TOKEN), so the credential need not survive into the docker build step.

Coverage

Wires @vitest/coverage-v8 with per-metric floors — statements 50, branches 48, functions 40, lines 50 — set just under measured so they ratchet against regressions rather than blocking today's work.

Scoped to src/plot and src/grbl, the framework-free core. src/ui and src/transport need a DOM and a live socket; folding them in would only buy a floor low enough to be meaningless. Current core coverage is 53.4% statements.

Agent and contributor docs

• AGENTS.md as the canonical agent config, CLAUDE.md as a symlink to it. It leads with the machine-safety rules: never interrupt a running plot (there is no resume), no limit switches, inverted Z, identity axis mapping, and the open-the-port-exactly-once constraint behind the CH340 wedge.
• docs/agents/issue-tracker.md, plus the four missing triage labels (needs-triage, needs-info, ready-for-agent, ready-for-human) created on the remote.

Fixes found on the way

• README.md had an empty code block where the rollback instructions belonged.
• README.md claimed React 18; the project is on 19.
• dependabot.yml had no cooldown, so a compromised release could be proposed the day it lands. Now 7 days on both ecosystems.
• SECURITY.md hedged that private vulnerability reporting "should be enabled" — verified it is, so the text is now definite.

Verification

• mise run ci passes: format-check, both typechecks, 53 tests, build.
• The coverage floor was confirmed to actually fail the build when breached, rather than just being written down.
• zizmor --collect=all --strict-collection . reports no findings with online audits enabled; actionlint is clean. No suppressions were added.

The one thing that cannot be verified before merge is this workflow itself: it now builds the serialport native binding under Node 22.20.0 instead of 20. Worth watching the first run on this PR.

🤖 Generated with Claude Code