feat(ci): add CI quality gates - CODEOWNERS, markdownlint, link checking

[Mossaka]

Summary

• Adds .github/CODEOWNERS for automatic reviewer assignment on PRs ([plan] create codeowners file for automatic reviewer assignment #350)
• Adds markdownlint-cli2 with relaxed baseline config, lint:md npm script, and CI job in lint.yml ([plan] add markdown linting workflow #352)
• Adds link checking workflow (link-check.yml) using lychee, running on PR markdown changes and weekly ([plan] add link checking workflow for documentation #353)
• SARIF npm audit was already implemented in dependency-audit.yml — no changes needed
• Fixes duplicate heading in github-agentic-workflows.md caught by markdownlint

Fixes #348, fixes #350, fixes #352, fixes #353

Test plan

• Verify npm run lint:md passes locally (0 errors confirmed)
• Verify ESLint still passes (npm run lint)
• Verify all unit tests pass (npm test — 946 passed)
• Verify CODEOWNERS syntax is valid on GitHub
• Verify markdownlint CI job runs in lint workflow
• Verify link-check workflow runs on PR

🤖 Generated with Claude Code

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	84.23%	84.36%	📈 +0.13%
Statements	84.21%	84.34%	📈 +0.13%
Functions	84.37%	84.37%	➡️ +0.00%
Branches	77.09%	77.17%	📈 +0.08%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/docker-manager.ts	86.8% → 87.3% (+0.52%)	86.1% → 86.6% (+0.50%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

Pull request overview

Adds Markdown quality checks to the repository’s CI by introducing Markdown linting and link checking, alongside basic configuration for both.

Changes:

• Add markdownlint-cli2 and an npm script (lint:md) plus a .markdownlint.json ruleset.
• Extend the existing GitHub Actions lint workflow with a dedicated Markdown lint job.
• Add a scheduled + PR-scoped link-check workflow using Lychee with a repo config, and introduce a CODEOWNERS file.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Adds lint:md script and markdownlint-cli2 dev dependency.
package-lock.json	Locks markdownlint-cli2 and its transitive dependencies.
.markdownlint.json	Defines markdownlint rule configuration used by the new lint step.
.github/workflows/lint.yml	Adds a new markdownlint job alongside ESLint.
.github/workflows/link-check.yml	New workflow to check Markdown links on PRs and on a weekly schedule.
.github/lychee.toml	Lychee configuration (exclusions, retries, concurrency).
.github/CODEOWNERS	Adds CODEOWNERS coverage for key repo areas and a default owner.
.github/aw/github-agentic-workflows.md	Minor documentation heading update.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Smoke test results for @Mossaka:

✅ GitHub MCP — Last 2 merged PRs: #1267 "fix: drop -f from curl to avoid GitHub API rate-limit flakiness", #1265 "fix: add missing formatItem and program imports in cli.test.ts"
✅ Playwright — github.com title contains "GitHub"
✅ File write — /tmp/gh-aw/agent/smoke-test-copilot-23028773447.txt created
✅ Bash — file read back successfully

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot for issue #1269

[github-actions]

Smoke Test Results

• ✅ GitHub MCP: feat(proxy): add GitHub Enterprise Cloud/Server support with automatic endpoint detection #1264 feat(proxy): add GitHub Enterprise Cloud/Server support; fix: drop -f from curl to avoid GitHub API rate-limit flakiness #1267 fix: drop -f from curl to avoid GitHub API rate-limit flakiness
• ✅ Playwright: github.com title contains "GitHub"
• ✅ File Write: /tmp/gh-aw/agent/smoke-test-claude-23028773416.txt created
• ✅ Bash: File verified via cat

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1269

[github-actions]

Smoke test results:
Merged PRs (GitHub MCP): ✅ — feat(proxy): add GitHub Enterprise Cloud/Server support with automatic endpoint detection | fix: drop -f from curl to avoid GitHub API rate-limit flakiness
PR list (safeinputs-gh): ✅ — feat(ci): add CI quality gates - CODEOWNERS, markdownlint, link checking | fix: add missing formatItem and program imports in cli.test.ts
Playwright title check: ✅
Tavily search: ❌ (tool unavailable)
File write: ✅
Bash cat: ✅
Discussion comment: ✅
Build (npm ci && npm run build): ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1269

[github-actions]

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.14.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: ⚠️ Not all versions match — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot for issue #1269