fix(ci): prune 6 stale eslint suppressions that made npm run lint exit 2 (#15159 G-05) - #15283

…xit 2 (diegosouzapw#15159 G-05)

ESLint fails an entire run when the suppressions file carries entries whose
violation no longer occurs:

  There are suppressions left that do not occur anymore. To resolve this,
  re-run the command with `--prune-suppressions` …

So the debt is not cosmetic — `npm run lint` exited **2** on every PR. The step
in ci.yml is the `lint` job, which gates every other job through its own failure.

Six entries were stale. All six are `@typescript-eslint/no-unused-vars`:

  open-sse/translator/request/openai-to-cursor.ts                        (3)
  src/app/(dashboard)/.../settings/components/SystemStorageTab.tsx       (1)
  src/app/api/v1/vscode/[token]/combos/route.ts                         (1)
  src/app/api/v1/vscode/raw/[token]/combos/route.ts                     (1)
  src/lib/oauth/providers/ghe-copilot.ts                                (1)
  tests/unit/cursor-agent-session.test.ts                                (?)

Each was re-linted directly with an EMPTY suppressions file and
`no-unused-vars` forced to error: zero violations on all six. That check is also
why pruning is safe to do on one platform and land on another — `no-unused-vars`
is platform-independent, so the Windows dev machine and the Linux CI runner
produce the same file. 1094 → 1088 suppressed violations; nothing else changed.

## Verification (release/v3.8.52 @ dbe703a)

| Check | Before | After |
| --- | --- | --- |
| `npm run lint` | **exit 2** | **exit 0** |
| `lint:json` totals (11786 files) | — | 0 errors, 0 warnings |
| suppressed violations | 1094 | 1088 |
| diff | — | exactly 6 removals, 1 insertion (trailing comma) |

The ratchet metric does not move: the baseline note already records that
`lint:json` measures 0 with suppressions applied, and a pruned entry was not
counted before or after.

## Tests

`tests/unit/build/eslint-suppressions-pruned.test.ts` — 6/6.

Five are cheap and pin the invariant: the six known-stale entries stay gone, no
empty file/rule buckets survive a hand-edit, suppression keys stay
POSIX-relative (a backslash key silently stops matching, which looks identical
to "unpruned" from the gate's exit code), and a `SHAPE-SANITY` case pins that the
file is keyed by FILE first, then rule.

That last one exists because the first draft of this suite got the nesting
backwards — every lookup missed, and "no stale entries" passed **vacuously** while
the gate was red. A test that cannot fail proves nothing; the sanity case is what
makes the other four trustworthy.

The sixth runs the real ESLint gate on the real repo (~3.5 min) and asserts it
does not exit 2.

Refs diegosouzapw#15159 (G-05)

The CI lint job is the real gate; keep only the cheap invariant checks.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>