fix(ci): enable no-eval for the website application tree (#7699)

[CrysisDeu]

Summary

no-eval is not part of eslint:recommended, and the base files: ['src/**/*.{ts,tsx}'] block in website/eslint.config.js never enabled it — so eval was unlinted across the entire application tree. This adds 'no-eval': 'error' to that base block.

The tree is at zero eval sites in .ts/.tsx (every eval match under src/ is prose in comments, per the issue's scope check and re-verified here), so this is a hard-zero error like the native-<select> gate, not a warn riding the --max-warnings budget.

Closes #7699

What #7569 already covered (and why this PR is one line of config)

Issue #7699 proposed three hunks. Two of them landed on main via #7569 before this PR:

• the src/**/*.mjs block enabling no-eval (making the generator's line-173 disable directive used and killing the permanent unused-directive warning), and
• the ratchet: ci.yml now runs npx eslint src/ --max-warnings 0, so the "lower the ceiling" hunk is obsolete — the ceiling is already at the floor.

The remaining gap was the base application block, which is this PR. Per the issue, the .mjs generator file itself is untouched (its directive stays as-is, now live via the existing .mjs block).

Deliberately out of scope

• no-new-func (the new Function in serviceWorkerSkipRules.test.ts) — the reporter explicitly excluded it as a separate decision. Note: no-eval also does not cover no-implied-eval (string-arg setTimeout/setInterval), so this PR narrows the eval-family gap rather than closing it entirely; those two rules remain a possible follow-up.
• The ArtifactsPage: the artifacts fallback breaks three hooks' memoization and pushed the eslint ratchet over #7695 exhaustive-deps fix — explicitly not folded in.

Pattern harvest

Rule candidate: eslint config self-check — a // eslint-disable-next-line <rule> directive is only meaningful when some config block matching that file enables <rule>; a directive naming a never-enabled rule is a permanent unused-directive warning. ESLint's own linterOptions.reportUnusedDisableDirectives: 'error' (flat config) is the built-in detector for this class and would turn the silent decay into a hard failure; the tree is already at zero unused directives, so it could land as a hard-zero gate. Beyond that, the specific defect class (security-relevant rules like no-eval/no-new-func/no-implied-eval absent from the base block) is closed for no-eval by this PR and enumerated as follow-up above.

Verification

• cd website && npx eslint src/ → exit 0, 0 errors, 0 warnings (measured count 0 under the --max-warnings 0 ceiling; the one deliberate eval in crew-ghost-sprite.gen.mjs stays suppressed by its now-live directive)
• npx tsc -b → pass
• Pre-push review: GPT lane (gpt-5.6-sol) PASS; Opus lane (claude-opus-5) PASS with two Low advisories — the comment-direction fix is folded into this commit, the scope note is the paragraph above

no linked issue: linked — Closes #7699.

No UI change — lint config only, no screenshots warranted.

[github-actions]

UX Review (Fable 5) — ✅ PASS

UX-level review of 348db79a87cafa70c2104f8b18e169bd01ef15e3 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

UX-Verdict: PASS

Lint-config-only change; no user-facing surface, string, or pixel is touched.

[UX-REVIEWED] 348db79

[github-actions]

Design Review (Fable 5) — ✅ PASS

Design-level review of 348db79a87cafa70c2104f8b18e169bd01ef15e3 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Design-Verdict: PASS

One-line hard-zero lint gate closing a verified real gap; claims check out against the tree (zero eval sites, .mjs block already live).

[DESIGN-REVIEWED] 348db79

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed 348db79a87cafa70c2104f8b18e169bd01ef15e3 — this comment is updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] 348db79

Verdict parsed from the review's SHA-scoped output markers for commit 348db79a87cafa70c2104f8b18e169bd01ef15e3.

False positive or not applicable? A repository writer can comment:
/ai-review override fable 348db79a87cafa70c2104f8b18e169bd01ef15e3: <one-sentence reason>

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of 348db79a87cafa70c2104f8b18e169bd01ef15e3 and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 348db79

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 348db79a87cafa70c2104f8b18e169bd01ef15e3: <one-sentence reason>

[NicholasRBowers]

Tier 1 auto-approve: fix (1 files). Criteria: no conflict, no requested changes, security path denylist clean, design-doc gate clean, SAST annotations clean, security checklist all-NO, AI reviewers green. Category: single-file CI lint-config fix enabling no-eval for the website application tree with a clear root cause.