[Adeolu01]

Summary

This pull request delivers the Stage 1 "Repository, Tooling and Developer Experience" tooling in a single change, resolving four open issues. Each adds a quality gate that was documented or expected but not enforced, so formatting, commit-style, line-ending and dependency problems are caught locally and in CI rather than reaching reviewers.

All new workflows use SHA-pinned actions, matching the existing security.yml and sdk-ci.yml style, and the SDK test suite (365 tests), ESLint and typecheck all pass.

closes #92
closes #90
closes #89
closes #85

What changed

Line endings (#85)

• Added .gitattributes forcing LF for *.sh, *.rs, *.ts, *.md (and the other text formats in the tree: *.toml, *.json, *.yml, *.yaml, *.cjs, *.mjs), with a sensible * text=auto eol=lf default and binary assets excluded.
• Marked Cargo.lock and **/package-lock.json as linguist-generated so GitHub collapses them in diffs.
• Re-normalized the tree once (git add --renormalize .). git ls-files --eol now shows no CRLF (i/crlf or i/mixed) in the index.
• Added a Line Endings workflow that fails any pull request reintroducing CRLF into the index.

Commitlint (#90)

• Added commitlint.config.cjs extending @commitlint/config-conventional, pinning the type-enum to exactly the types documented in CONTRIBUTING.md (feat, fix, docs, test, refactor, chore, perf) and a scope-enum of the documented scopes plus the vault and common crates that have since been added to the workspace, and deps/release for automation. Merge commits are ignored.
• Added a Commitlint workflow that lints every commit in a pull request range. A non-conforming commit fails the check.
• Documented the allowed scopes and the enforcement in CONTRIBUTING.md.

Pre-commit hooks (#89)

• Added .pre-commit-config.yaml with:
  • LF line-ending normalization (matching .gitattributes).
  • cargo fmt --check on staged Rust.
  • ESLint on the SDK when a staged .ts file changes.
  • commitlint on the commit message (commit-msg stage).
• Added a make hooks target that installs the pre-commit and commit-msg hooks, and documented the install steps in CONTRIBUTING.md.

Unused dependencies (#92)

• Added an Unused Dependencies workflow running cargo-machete on pull requests, on a weekly schedule, and on demand, installed pinned and --locked to mirror how security.yml installs cargo-audit.
• Added a make udeps target and documented it.
• Ran cargo-machete across the workspace: it reports no unused dependencies, so none were removed.

Supporting changes

• Added a working flat ESLint configuration for the SDK (sdk/eslint.config.mjs, typescript-eslint), encoding the "no any" and unused-code parts of the CONTRIBUTING.md TypeScript policy. The SDK's lint script (previously referencing an uninstalled ESLint) now runs, and a Lint step was added to the SDK CI job.
• Removed one unused rpc type import in sdk/src/vault.ts that the new lint surfaced (it was referenced only in doc comments). No runtime or public API change.
• Added unit tests for both new configurations:
  • sdk/tests/eslint-config.test.ts asserts the config passes clean strictly-typed code and flags any and unused variables (allowing the _ convention).
  • sdk/tests/commitlint.config.test.ts loads the real commitlint.config.cjs and asserts it accepts conforming commits (including the vault/common scopes and scope-less commits) and rejects unknown types, unknown scopes, over-length subjects and non-conventional subjects.
• Updated CHANGELOG.md under Unreleased.

Testing

• cd sdk && npm run lint - passes.
• cd sdk && npm run typecheck - passes.
• cd sdk && npm test - 365 tests pass, including the two new config test files.
• cargo machete - reports no unused dependencies.
• git ls-files --eol | grep -Ei '^i/(crlf|mixed)' - no matches.
• All new YAML workflows validated.

Notes

• The commitlint CI job installs @commitlint/cli and @commitlint/config-conventional at pinned versions with npm install --no-save (the repository root has no package.json); this was verified to resolve the extends and lint correctly.
• cargo-machete found nothing to remove in the current workspace, so this pull request adds the gate without any dependency deletions. The gate will fail future pull requests that add an unused dependency.