fix(ci): repo-wide lint gate fixes (eslint, lint-ga, lint-k8s, text)

[vitaliytv]

Summary

Four CI checks (eslint, lint-ga, lint-k8s, text) were failing on #26, independent of the mt-core dependency fix that PR shipped. This PR addresses those four, each root-caused separately:

• eslint/knip: knip.json's ignore list still pointed at .pi/extensions/n-cursor-adr/** — the directory was renamed to n-rules-adr a while back — plus rtk.ts was never added to the ignore list at all. Also @7n/rules-ci-github/-lang-js/-lang-rust were flagged as unused devDependencies; they're actually consumed as plugins by the @7n/rules CLI, not via JS import, so knip's static analysis can't see the usage.
• lint-ga / lint-js / lint-text: on.pull_request.paths was missing or incomplete on three workflow files. push.paths filtered the trigger correctly, but pull_request ran unconditionally on every PR — and then failed its own drift-check against canon for not matching the expected glob set.
• text: .cspell.json was missing a handful of legitimate Ukrainian words (мейнтейнера, недовірений, стрімоване, plus доставки/залежнісного that showed up in freshly-regenerated docs). Also fixed pre-existing oxfmt/eslint/stylelint formatting drift in PullRequestsDialog.vue and TaskGraph.vue — found a wrapping style compatible with all three linters at once (oxfmt's own preferred wrap for a q-badge mustache conflicted with eslint's vue/multiline-html-element-content-newline, and its CSS reflow needed stylelint's rule-empty-line-before blank lines added).
• k8s: k8s/teleport/ingress.yaml actually contained a NetworkPolicy resource (not an Ingress) under the wrong filename, so the mandatory-NetworkPolicy check couldn't find it for the teleport StatefulSet. Renamed to networkpolicy.yaml and added the intra-replica ingress/egress rules required by the StatefulSet canon snippet.

Also regenerated the two doc files (docs/PullRequestsDialog.md, docs/TaskGraph.md) per this repo's doc-files convention, since their source files changed.

Deliberately out of scope (discussed and agreed)

• kubescape: kubescape scan k8s surfaces ~17 distinct security-posture controls across the whole k8s/ tree (RBAC delete capabilities, non-root containers, immutable filesystem, naked pods, a second missing NetworkPolicy for the naked Pod in k8s/dev-pod/template.yaml, etc.). This is a pre-existing hardening backlog, not a quick CI fix — several findings need functional judgment calls (e.g. does teleport's container actually need root, is the RBAC delete capability load-bearing) that are better handled as their own scoped effort.
• doc-files: ~19 other files (app/src/*.js, owner/src/*.js) have stale docs unrelated to this PR's diff — left alone to keep this change focused.

Verification

Ran each fixed check locally with the exact tool version pinned in bun.lock (1.51.0 — my first pass used a stale 1.45.0 install and chased a couple of false positives/negatives before catching that):

• npx @7n/rules lint ga --no-fix → clean
• npx @7n/rules lint js --no-fix → clean
• npx @7n/rules lint text --no-fix → clean
• npx @7n/rules lint style --no-fix → clean
• bunx knip --no-config-hints → clean
• npx @7n/rules lint k8s --no-fix → only the deliberately-deferred kubescape backlog remains (missing-NetworkPolicy violation for teleport is gone)

Test plan

• CI green on eslint, lint-ga, lint-js, lint-text for this PR
• lint-k8s still shows the kubescape security-posture backlog (expected, tracked separately)

🤖 Generated with Claude Code