fix: pilot findings on real Runroom repositories; release 1.3.0

[Cenadros]

Summary

A pilot of the gate on aulaclinic_web (Next + Payload), Colonial (Drupal 11) and santalucia-reports (Python 3.14 + Vite frontend) surfaced these issues. After the fixes, init and check pass on all three.

Repo	Before	After
aulaclinic_web	138 complexity, 17 unused	67 complexity (JSX thresholds), 15 unused
Colonial	composer install aborted (no patch)	init and check PASS, TS unused included
santalucia-reports	deptry 3833 findings then crash; frontend undetected	deptry 9 plausible findings; frontend detected; Knip runs

• Image ships patch for composer-patches.
• deptry: first-party packages from the Python paths, repeated diagnostics counted, test exclusions with picomatch-compatible regexes, distribution→module map from the consumer .venv keyed by the declared spelling, untrusted names validated.
• TS detected from depth-1 directories with their own package.json (not cypress/, e2e/, fixtures/…).
• Knip runs from the sole owning package when the root has no package.json; adds global-not-found and next-intl entries.
• Python module-level diagnostics no longer print anchor fallback notices.
• JSX thresholds: complexity 15, 120 lines per function.
• docs/ci.md: setup may chain installers (composer install --no-interaction && npm ci).

Release

Version 1.3.0 (root, launcher, CLI_VERSION). POLICY_VERSION is 2026-09-23.2; after upgrading, remove quality/ and run code-quality check --initialize.

Verification

• typecheck, lint, 722 tests.
• pnpm docker:build && pnpm integration: all rows green; all fixture and repository baselines regenerated.
• Closing correctness and security review: 3 Important and 10 Minor findings fixed.