chore: migrate to the @j4k scope on the Forge npm registry

[Jercik]

Phase 4 (§1B) migration of the private-dep install path from Verdaccio
(npm.j4k.dev) to the Forgejo npm registry (code.j4k.dev).

What changed

• Dep rename: oxlint-config-j4k -> @j4k/oxlint-config (^2.11.0,
  the only version on the Forge). Managed oxlint.config.ts import
  re-rendered by j4k-align --fix.
• pnpm-workspace.yaml registries flip: default: https://registry.npmjs.org/ + "@j4k": https://code.j4k.dev/api/packages/j4k/npm/, with
  minimumReleaseAgeIgnoreMissingTime: false and an @j4k/*
  release-age exclude (the Forge serves no time metadata).
• Workflows re-rendered (current-gen): checks / dedupe-check /
  release-npm install auth is now NODE_AUTH_TOKEN: secrets.FORGEJO_NPM_TOKEN writing a code.j4k.dev _authToken line,
  each guarded by a missing-secret check. pr-review passes
  FORGEJO_NPM_TOKEN into the axgithub reusable's legacy NPM_TOKEN
  secret input.
• Floors bumped by --fix: oxlint ^1.72.0, oxfmt ^0.57.0,
  packageManager pnpm@11.8.0; managed types/css-modules.d.ts shim,
  .githooks/pre-commit, .oxfmtrc.json, .gitignore worktrees entry.
• Lockfile rebuilt against the Forge: forced re-resolution of
  @j4k/oxlint-config + pnpm dedupe. grep -c npm.j4k.dev pnpm-lock.yaml is 0; a cold-store pnpm install --frozen-lockfile
  (fresh --store-dir) fetched @j4k/oxlint-config@2.11.0 from the
  Forge and passed integrity.
• knip: entry widened to types/**/*.d.ts so the newly-managed
  css-modules.d.ts ambient shim is an entry point, not an unused file.

Secret change (action needed on other open PRs)

--fix deleted the repo-scoped NPM_TOKEN Actions secret (forbidden
post-flip). Any pre-flip branch's CI will fail its install step until
this PR merges to main and that branch is refreshed with main.
FORGEJO_NPM_TOKEN was already provisioned on this repo.

Known advisory breakage (do not chase)

pr-review delegates to Jercik/axgithub@v1, still the Verdaccio-era
reusable. Passing FORGEJO_NPM_TOKEN to it authenticates against the
wrong registry, so PR Review draws will be red until the owner
re-tags axgithub v1 (PRs #6/#7 pending). pr-review is not a
required status check.

Out of scope (pre-existing, advisory)

engines.node ">=24.0.0" is below the >=24.15.0 audit floor and 7
devDeps are behind latest — both advisory, unrelated to the registry
flip, and left untouched so this stays a non-releasing change.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f939423cc5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the WHAT-only hook comment

AGENTS.md's “Comments Explain Why, Not What” rule says to default to no comments and never explain what the code already shows. This added line only narrates the immediately following run_script body—echoing a header, capturing output, and exiting on failure—so it violates the repo's documented comment standard without adding non-obvious context; remove it or replace it with the hidden reason this wrapper exists.

Useful? React with 👍 / 👎.