refactor: enable oxlint complexity rule (max 20) and refactor offenders

[dyoshikawa]

Summary

Enables the oxlint complexity rule with a maximum of 20 in .oxlintrc.json and refactors the 24 functions that exceeded the threshold so the whole codebase passes with --max-warnings 0.

"rules": {
  "complexity": ["error", { "max": 20 }],
  ...
}

This guards against future complexity creep (CI fails on any function over 20).

Approach

All refactors are pure, behavior-preserving extractions:

• Cohesive blocks pulled into well-named module-level helpers (or private methods) in the same file.
• Structurally-similar branch ladders (hook event-name maps, permission category mapping) replaced with lookup tables.
• Guard clauses hoisted to flatten nesting.

No public signatures, return values, entry ordering, warning/error messages, or side effects changed.

Refactored functions (complexity → ≤20)

Area	File	Function(s)
config	config/config-resolver.ts	resolve (52)
mcp	mcp/tools.ts	execute (44)
cli	cli/commands/generate.ts	generateCommand (35)
hooks	features/hooks/tool-hooks-converter.ts	canonicalToToolHooks (43), toolHooksToCanonical (35)
hooks	features/hooks/{qwencode,geminicli,copilotcli,kiro,vibe}-hooks.ts, opencode-style-generator.ts	6 converters (29/27/28/22/21/24)
lib	lib/gh/gh-install.ts	installGh (37), installSource (37)
lib	lib/sources.ts	fetchSource (30), resolveAndFetchSources (23)
lib	lib/apm/apm-install.ts	installDependency (25), installApm (24)
lib	lib/update.ts	performBinaryUpdate (23)
mcp	features/mcp/{goose,kilo}-mcp.ts	convertToGooseFormat (27), kilo map callback (21)
skills	features/skills/vibe-skill.ts	fromRulesyncSkill (28)
permissions	features/permissions/{codexcli,cline}-permissions.ts	convertRulesyncToCodexProfile (23), fromRulesyncPermissions (21)
rules	features/rules/rules-processor.ts	convertRulesyncFilesToToolFiles (23)

Verification

• npx oxlint . --max-warnings 0 — clean (0 complexity violations).
• pnpm cicheck — green (6790 unit tests, typecheck, format, content checks all pass).
• e2e suite validated locally (the compiled-binary e2e runs in CI across macOS/Linux/Windows).

Closes #2007

🤖 Generated with Claude Code

[dyoshikawa]

@dyoshikawa Thank you!