feat!: flat-config ESLint 10 rewrite with JS and TypeScript entries (8.0.0) - #8

Summary

Replaces the legacy @cospired/eslint-config-base and -react packages (ESLint 8, .eslintrc, airbnb, hapi) with ESLint 10 flat configs. Both packages release as 8.0.0. One setup replaces the per-project TypeScript config we kept copying between repos.

Entries (all work with no options)

eslint.config.js is one line: export { default } from '@cospired/eslint-config-base/node';

What changed

• No airbnb, no hapi. Built on ESLint and typescript-eslint recommended presets. hapi scope-start is dropped because Prettier strips block-leading blank lines; blank lines before return and after declarations come from @stylistic/padding-line-between-statements.
• Every rule is configured. For ESLint core, typescript-eslint, import-x, eslint-comments, todo-plz, @Stylistic, react-hooks, react-refresh and formatjs, each non-deprecated rule is set by a preset or by us (on, or off on purpose). A completeness test per package fails on any gap, so new plugin releases can't add silent ones. This replaces eslint-find-rules --unused.
• Split by plugin in src/rules/ (eslint.js, typescript-eslint.js, import-x.js, eslint-comments.js, todo-plz.js, stylistic.js; react: react-hooks.js, react-refresh.js, formatjs.js, react.js).
• Carried over from eventured: eslint-disable needs -- reason; TODOs need a ticket (TODO(#123)); alphabetized import groups; devDependency imports only in test, config and script files; explicit return types, no-misused-promises.
• No warn. Rules are error or off.
• Defaults that work out of the box: global ignores, project service, tests/scripts/package-root TS files linted without type info (typedTests: true opts in).
• Tooling: Babel, tape, eslint-find-rules and Travis are gone. Tests use node:test and the ESLint API. Versions go through changesets, and CI runs on GitHub Actions.

See MIGRATION.md for removed rules and peers, docs/rules.md for every rule with its source and decision, and RELEASING.md for the release steps.

Verification

• Tests: 95 tests pass (base 64, react 19, helpers and scripts 12). The repo lints itself with its own config.
• CI on GitHub: Node 20.19, 22.13 and 24; again with every peer at its minimum version (ESLint 10.0.0, typescript-eslint 8.72.2, TypeScript 5.4.2, ...); a pack smoke test that installs both tarballs into a clean project and lints with all six one-line configs; and a publish dry run with the pending changeset applied.
• Real projects: Scratch copies of eventured (api, frontend, api-contracts) and danceregistry (scraper, api, importer) lint with the one-line configs and no parse errors. Lint findings there are new rules finding real code and are not addressed in this PR.
• Publish dry run: changeset version gives 8.0.0 for both packages, react depends on base@^8.0.0, and npm publish --dry-run accepts both.

Please review

• About 200 on/off calls for rules nobody had decided are marked "added for completeness (unreviewed call)" in docs/rules.md. The "Explicitly off" section lists those switched off. Most likely to disagree with existing code: no-non-null-assertion (on), import-x/no-cycle (on).
• jsx-a11y is not included, because eslint-plugin-jsx-a11y doesn't support ESLint 10.
• formatjs/prefer-formatted-message is off, matching eventured's practice rather than the old cospired config.

Before the release publishes

• Add an npm credential: repo secret NPM_TOKEN, or npm trusted publishing (see RELEASING.md).
• Squash-merge this PR. The release workflow then opens a "chore: version packages" PR, and merging that publishes 8.0.0 for both packages.