Lint the full JS package in CI, not just src

[aram356]

Fixes #985.

Problem

The CI lint gate (npm run lint in format.yml) only covered src/**/*.{ts,tsx}, so eslint errors in test files, the Node build scripts, and config files were invisible: 280 of them had accumulated (npx eslint . on main), and new ones land unnoticed.

Fix

Widen the lint script to eslint . --max-warnings=0 and make the widened surface clean, with no rule exceptions:

• Tests: all 249 no-explicit-any violations are fixed with real types rather than suppressed. Window mocks are typed as Omit<Window, 'tsjs'> intersections with Partial<TsjsApi> from src/core/types; the prebid hoisted mock gets structural TestPbjs/TestAdUnit/TestBid types; many casts were simply unnecessary and are deleted (untyped vi.fn() already assigns to typeof fetch). One documented as unknown as double-cast remains, for a test that deliberately feeds malformed input. Side effect: repo-wide tsc --noEmit errors drop from 50 to 12, all remaining ones pre-existing in files this PR does not touch.
• Node scripts: declare ESM-safe Node globals (globals.nodeBuiltin) for *.mjs build scripts and Node-run test harnesses, so process/console/Buffer resolve but CommonJS-only names (__dirname, require) still fail no-undef.
• Unused args: honor the ^_ underscore convention in @typescript-eslint/no-unused-vars via a top-level rules block covering every linted file, not just *.ts(x).
• Warnings: --max-warnings=0 so rules landing at warn level cannot pass CI silently; this also fails on unused eslint-disable directives, keeping the remaining src/ directives honest.
• Mechanical fixes: import/order in five files, one prefer-const (mockPbjs declaration merged with its single assignment).

No workflow changes: format.yml already runs npm run lint; the script now covers the whole package.

Verification

• npx eslint . --max-warnings=0 exits 0
• npm run format clean
• npx vitest run: 488 passed, 0 failed (32 files)
• npx tsc --noEmit: no new errors vs main (50 -> 12)

[prk-Jr]

Summary

Widens the JS lint gate from src/** to the whole package and cleans the newly-covered surface. Behavior-neutral: no production src/ file is touched — every code edit is a comment removal, an import blank line, or the let→const restructure in the prebid mock. Verified locally: npx eslint . exits 0 (1.7s), and the dist ignore holds (dropped a deliberately-broken probe file into dist/, still exit 0). Approving; the findings below are all non-blocking.

Non-blocking

🤔 thinking

• Blanket no-explicit-any off for test/**: defensible at 249/280 and it matches the existing file convention, but it also covers shared helpers/fixtures where types are cheap, and new any in tests now lands with no signal. (eslint.config.js:53)
• .mjs gets a weaker gate than "full package" implies: project rules are scoped to **/*.ts(x), so the newly-covered build scripts only get js.configs.recommended + tseslint defaults. (eslint.config.js:46)

♻️ refactor

• The ^_ convention does not reach .mjs: the no-unused-vars options live in the **/*.ts block, but the rule is active with default options on .mjs. (eslint.config.js:38)

🌱 seedling

• lint has no --max-warnings=0: 0 warnings today, so no live gap — but any future 'warn'-level rule passes CI silently, which is the same class of hole this PR exists to close. (package.json:13)

📌 out of scope

• A second TypeScript package is still unlinted: crates/trusted-server-integration-tests/browser/ (Playwright specs, helpers/, global-setup.ts, playwright.config.ts) has no lint script and no format.yml job. If the intent of #985 is "no unlinted TS in CI", that is the remaining gap — worth a follow-up issue rather than scope creep here.

⛏ nitpick

• Stray blank lines where disable directives were removed: ten spots in test/integrations/gpt/ad_init.test.ts. Seven (1408, 1491, 1523, 1559, 1759, 1820, 1895) read fine as paragraph breaks; three inside two-line arrow bodies (1344, 1374, 1731) read oddly. Prettier will not collapse either.

👍 praise

• Forward-reference comment in the prebid mock: the let→const restructure could read as a TDZ hazard; the comment states exactly why it is not. (test/integrations/prebid/index.test.ts:25)
• Behavior-neutral diff: keeping the gate widening free of any production change makes "widen the gate, then clean the surface" easy to trust in review.

CI Status

All 19 checks pass on 959f4b9.

• cargo fmt / clippy: PASS
• rust tests (fastly, axum, cloudflare, spin, parity, CLI): PASS
• vitest: PASS
• format-typescript (eslint + prettier): PASS
• format-docs: PASS
• integration + browser integration tests: PASS

[ChristianPavilonis]

Summary

Reviewed the lint-surface expansion against main. The change is low risk and behavior-neutral overall; all CI checks and clean-checkout JS validation pass. I found one medium-severity lint-environment gap, noted inline.