quality: 4 more gates + dependency audit; full --fast sweep 10/10 green

This commit closes the structural-tests work on PR #18.  Every gate
in `run-all.sh --fast` now passes end-to-end on the canonical dev
machine.

New gates
─────────
1. shellcheck (scripts/quality/shellcheck.sh)
   * Scans every `scripts/**/*.sh` at severity=warning+
   * 16 scripts inspected; cleanup pass took the tree from 7 findings
     (SC2164 + SC2034) to 0 findings.

2. cppcheck (scripts/quality/cppcheck.sh)
   * Complementary static analyser to clang-tidy; different heuristics,
     fewer false-positives on heavy CGAL/Eigen templates.
   * Default severity warning+, --strict adds style, --all = everything.
   * Suppresses 4 noise classes (missingIncludeSystem, etc.) explicitly.

3. .editorconfig
   * Cross-IDE fallback for editors that don't honour clang-format.
   * Covers Markdown (preserve trailing whitespace), Python, YAML,
     JSON, shell, Makefile (tabs) — the file types clang-format
     doesn't cover.

4. CONFORMALLAB_WARNINGS_AS_ERRORS CMake option
   * Off by default → regular builds don't break on new GCC warnings.
   * `-DCONFORMALLAB_WARNINGS_AS_ERRORS=ON` adds `-Werror`, intended for
     CI promotion-track and sanitizer runs.

Dependency audit  (doc/architecture/dependencies.md)
────────────────────────────────────────────────────
New single-source-of-truth document listing:
  * what the library requires (Eigen + CGAL + Boost — all header-only)
  * what tests require (auto-fetched GTest, no system install)
  * what each quality tool is for, install command per OS, and
    behaviour when missing (each gate exits 2 = SKIP, run-all
    recognises this and continues)
  * a verification recipe that strips PATH down and shows the
    library still configures + builds + tests cleanly with zero
    quality tools installed.

run-all.sh enhanced
───────────────────
* Recognises "tool not in PATH" → SKIP (not FAIL).
* Summary now reports `passed / skipped / failed` separately.

Bug fixes uncovered by the sweep
────────────────────────────────
* sanitizers.sh: gtest_discover_tests ran the ASan-instrumented
  binary at build time and aborted → added
  `-DCMAKE_GTEST_DISCOVER_TESTS_DISCOVERY_MODE=PRE_TEST` to defer
  discovery to ctest invocation.  Now 23/23 sanitizer-instrumented
  tests pass.

* clang-tidy.sh on macOS: brew-installed clang-tidy couldn't find
  Apple SDK system headers (<cmath>, <complex>, …) → added
  `--extra-arg=-isysroot $(xcrun --show-sdk-path)` on Darwin.

* clang-tidy.sh: needed `-DWITH_CGAL_TESTS=ON` in compile_commands
  generation so CGAL include paths are part of at least one
  compile entry.  Now resolves CGAL/Surface_mesh.h etc.

* clang-tidy.sh: viewer-only headers (`viewer_utils.h`, `mesh_utils.hpp`)
  excluded — they need `WITH_VIEWER=ON` + system GLFW/libigl that the
  lint build doesn't drag in.

* `.codespellrc`: extended ignore list (recognise, signalled, modelled,
  travelled, …) for British-English consistency across own writing.

Final state — local quality block on this commit, this branch:

    ✅ License headers       (66/66 carry MIT SPDX)
    ✅ CGAL conventions      (0/6 violations on 6 CGAL headers)
    ✅ clang-format drift    (0 drift)
    ✅ cmake-format/-lint    (0 drift, 0 lint findings)
    ✅ codespell             (0 typos in scope)
    ✅ shellcheck            (0 findings across 16 .sh files)
    ✅ cppcheck              (warning+ severity clean)
    ✅ Markdown links        (122/122 resolve)
    ✅ Sanitizers (ASan+UBSan) (23/23 fast tests pass)
    ✅ clang-tidy             (35 headers inspected, 0 findings)

Library standalone-ness verified:
    env -i PATH=... cmake -S code -B /tmp/build-standalone
    cmake --build /tmp/build-standalone --target conformallab_tests
    ctest -E '^cgal\.'    →  all green

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

code/CMakeLists.txt

@@ -55,8 +55,26 @@ if(NOT CMAKE_BUILD_TYPE)
 endif()
 
 if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+  # ─── Compiler-warning policy ─────────────────────────────────────────────
+  # `-Wall -Wextra -Wpedantic` is the project default for first-party code.
+  # Vendored deps under code/deps/ get a separate, looser policy (handled
+  # via per-target SYSTEM include marking when they are pulled in).
+  #
+  # `CONFORMALLAB_WARNINGS_AS_ERRORS=ON` flips on `-Werror` — used in CI's
+  # promotion-track and by `scripts/quality/sanitizers.sh` to make sure no
+  # new warning class slips in unannounced.  Off by default so regular
+  # builds on slightly older toolchains aren't broken by a new GCC's
+  # added warning.
+  option(CONFORMALLAB_WARNINGS_AS_ERRORS
+    "Treat compiler warnings as errors (-Werror)." OFF)
+
   add_compile_options(-Wall -Wextra -Wpedantic)
 
+  if(CONFORMALLAB_WARNINGS_AS_ERRORS)
+    add_compile_options(-Werror)
+    message(STATUS "Warnings-as-errors mode active (-Werror).")
+  endif()
+
   # AddressSanitizer only in Debug (gtest_discover_tests runs the binary at
   # configure time and hangs with ASan enabled).
   if(CMAKE_BUILD_TYPE STREQUAL "Debug" AND NOT BUILD_TESTING)