ci: establish modular repository tooling baseline

[TheDanniCraft]

📝 Description

Replaces the temporary repository-enrolled TypeScript profile with a modular,
repository-owned tooling declaration.

Each repository explicitly opts into the modules it needs through
.github/payloadbay-baseline.json. The organization baseline resolves module
dependencies and centrally maintains the declared package contract, static
configuration, workflow, and required check. It does not guess from repository
names, source files, or existing dependencies.

The first module set covers Bun, TypeScript, Biome, Vitest, Fallow, and the
Code Quality workflow. Their canonical assets live under .github/modules/
and are mapped explicitly to their target paths in enrolled repositories. A
reviewed repository declaration is the approval point for the selected module
contract. Repository Baseline applies it directly through the organization
GitHub App, refuses conflicts with repository-owned values, and regenerates
bun.lock without lifecycle scripts. It then applies static module files and
enables the module ruleset only after its workflow is present.

Recipes are intentionally out of scope. They can later become aliases for
repeated, proven module combinations without changing the explicit module
model.

🧩 Type of Change

• 🧪 Tests
• 🤖 CI/CD or automation
• 🧹 Maintenance

🗺️ Areas

• Architecture
• Infrastructure

🧪 Testing and Validation

node --check .github/scripts/repository-baseline.mjs
node --check .github/scripts/module-bootstrap.mjs
node --test .github/scripts/*.test.mjs
JSON parse checks for baseline configuration and schema
git diff --check

All checks passed locally.

🔐 Security, Compatibility, and Operations

The module declaration is opt-in and read only from a repository's default
branch. Repository Baseline uses the existing organization GitHub App only for
the selected Payload Bay repository. It refuses package or managed-file
conflicts and runs bun install --lockfile-only --ignore-scripts, so repository
lifecycle scripts are not executed.

The Code Quality ruleset is added only after the matching workflow has been
synchronized. Reverting a declaration or a module remains an explicit,
reviewable repository change.

📋 Checklist

• I have read and understood the Contribution Guidelines
• This pull request addresses one focused change
• My pull-request title follows Conventional Commits
• My commit messages follow Conventional Commits
• I have performed a self-review of the complete diff
• I understand and can explain every submitted change
• I have removed debug output, unrelated changes, and generated noise
• I have added or updated appropriate tests, or explained why none are needed
• I have updated relevant documentation, or explained why none is needed
• My changes introduce no unexpected warnings or errors
• I have considered security, compatibility, deployment, and rollback effects
• I have not included credentials, secrets, private payloads, or personal data
• Any required dependent changes are linked and clearly identified

🤖 AI Usage

• 🤖 This pull request includes AI-assisted work

🛠️ How AI Was Used

• 🔍 Code review or analysis
• 🧠 Ideation, research, or planning
• ✍️ Drafting code
• ♻️ Modifying or refactoring code
• 📝 Drafting or editing documentation or other text
• 🧪 Designing tests or validation steps
• 🐛 Debugging or investigating a failure

🔎 AI Tools and Human Review

Codex assisted with the design and implementation. The module contract,
synchronization flow, workflow, documentation, and tests were reviewed against
the agreed model. The listed validation commands were run on the final worktree.

✅ AI Responsibility

• I reviewed all AI-assisted content line by line
• I verified factual, technical, security, and licensing claims
• I tested the resulting behavior rather than trusting generated assertions
• I accept full responsibility for the submitted work
• I confirm this contribution is not automated spam or generic AI slop

💬 Additional Context

Tracked in PAB-62. The Core repository will declare its modules and receive a
separate generated setup PR after this baseline is merged.