[Harry19081]

Problem

The repository root mixes tool-specific configuration and a generated Node helper with standard repository entrypoints. This adds clutter even though most configuration can live in existing directories.

Solution

Reduce tracked root files from 16 to 11 under one repository-cleanup objective:

• Move Knip and Gitleaks configuration into config/, updating package scripts, CI, scanner fixtures, and contributor documentation.
• Move Oxlint configuration to src/.oxlintrc.json, adjusting its schema, override, and exclusion paths. Oxlint scopes exclusions to the config directory, so config/ would not preserve source exclusions.
• Fold the former .eslintignore exclusion into ESLint settings in package.json and preserve it in Oxlint.
• Generate the backend Node helper in src-tauri/bin/ alongside the semantic helper.
• Make changes to the relocated Oxlint config trigger full CI lint selection, with regression coverage.

Keep standard root entrypoints and .prettierignore for tool/editor discovery. No dependencies, lockfiles, application UI, schemas, or wire contracts change.

Potential risks

External scripts or editor settings that hard-code the previous config paths must use the documented replacements. Direct Knip and Gitleaks invocations now need explicit config paths; repository entrypoints are updated. The Node helper destination changes for subsequent setup runs; older checkouts may retain their old ignored root symlink. On this machine, the old symlink was removed only after verifying the new one has the same target.

Helper setup was exercised on macOS arm64; packaged desktop builds, other operating systems, and editor integrations were not exercised. Reverting this commit restores the original config paths; rerunning node scripts/setup/sidecar-symlinks.js after a revert restores the root helper. No persisted application data is changed.

Verification

• pnpm lint:fast — passed with the relocated config and preserved source exclusions/override.
• node --test scripts/ci/select-lint-targets.test.cjs — 7 passed.
• GITLEAKS_DOCKER_IMAGE=ghcr.io/gitleaks/gitleaks:v8.24.3 node --test scripts/security/gitleaks.test.cjs — 5 passed. The initial native invocation could not run because Gitleaks was not installed; Docker supplied the CI-pinned scanner.
• pnpm exec knip --reporter json before relocation and pnpm exec knip --config config/knip.json --reporter json afterward — both reported existing findings (exit 1); JSON findings matched after normalizing ordering.
• pnpm exec prettier --check package.json src/.oxlintrc.json config/knip.json scripts/setup/sidecar-symlinks.js scripts/security/gitleaks.test.cjs .github/CONTRIBUTING.md .github/workflows/ci.yml — passed.
• pnpm exec prettier --check scripts/ci/select-lint-targets.cjs scripts/ci/select-lint-targets.test.cjs — passed.
• node scripts/setup/sidecar-symlinks.js — passed; generated backend helper at its new destination.
• Checked ESLint's isPathIgnored: vendored QR implementation remains ignored; src/icons.ts remains included.
• git diff origin/develop...HEAD --check and commit hooks — passed. Final scope inspection excludes unrelated onboarding work, generated helpers, personal paths, and new secrets.
• Full application builds, TypeScript/Rust checks, and UI screenshots were not run: this change relocates developer tooling and changes no application source or UI. Hook type/Rust checks correctly skipped because no TypeScript or Rust files were staged.

Audit

Architecture review covered config validity, deduplication, path naming, discoverability, and CLI/CI setup consistency (layers 1, 2, 3, 7, and 9). Domain semantics, control flow, cross-domain boundaries, wire serialization, and multi-field resolvers (layers 4, 5, 6, 8, and 10) are unchanged and were outside this configuration-only review.