quality: 4 more gates + dependency audit; full --fast sweep 10/10 green

This commit closes the structural-tests work on PR #18.  Every gate
in `run-all.sh --fast` now passes end-to-end on the canonical dev
machine.

New gates
─────────
1. shellcheck (scripts/quality/shellcheck.sh)
   * Scans every `scripts/**/*.sh` at severity=warning+
   * 16 scripts inspected; cleanup pass took the tree from 7 findings
     (SC2164 + SC2034) to 0 findings.

2. cppcheck (scripts/quality/cppcheck.sh)
   * Complementary static analyser to clang-tidy; different heuristics,
     fewer false-positives on heavy CGAL/Eigen templates.
   * Default severity warning+, --strict adds style, --all = everything.
   * Suppresses 4 noise classes (missingIncludeSystem, etc.) explicitly.

3. .editorconfig
   * Cross-IDE fallback for editors that don't honour clang-format.
   * Covers Markdown (preserve trailing whitespace), Python, YAML,
     JSON, shell, Makefile (tabs) — the file types clang-format
     doesn't cover.

4. CONFORMALLAB_WARNINGS_AS_ERRORS CMake option
   * Off by default → regular builds don't break on new GCC warnings.
   * `-DCONFORMALLAB_WARNINGS_AS_ERRORS=ON` adds `-Werror`, intended for
     CI promotion-track and sanitizer runs.

Dependency audit  (doc/architecture/dependencies.md)
────────────────────────────────────────────────────
New single-source-of-truth document listing:
  * what the library requires (Eigen + CGAL + Boost — all header-only)
  * what tests require (auto-fetched GTest, no system install)
  * what each quality tool is for, install command per OS, and
    behaviour when missing (each gate exits 2 = SKIP, run-all
    recognises this and continues)
  * a verification recipe that strips PATH down and shows the
    library still configures + builds + tests cleanly with zero
    quality tools installed.

run-all.sh enhanced
───────────────────
* Recognises "tool not in PATH" → SKIP (not FAIL).
* Summary now reports `passed / skipped / failed` separately.

Bug fixes uncovered by the sweep
────────────────────────────────
* sanitizers.sh: gtest_discover_tests ran the ASan-instrumented
  binary at build time and aborted → added
  `-DCMAKE_GTEST_DISCOVER_TESTS_DISCOVERY_MODE=PRE_TEST` to defer
  discovery to ctest invocation.  Now 23/23 sanitizer-instrumented
  tests pass.

* clang-tidy.sh on macOS: brew-installed clang-tidy couldn't find
  Apple SDK system headers (<cmath>, <complex>, …) → added
  `--extra-arg=-isysroot $(xcrun --show-sdk-path)` on Darwin.

* clang-tidy.sh: needed `-DWITH_CGAL_TESTS=ON` in compile_commands
  generation so CGAL include paths are part of at least one
  compile entry.  Now resolves CGAL/Surface_mesh.h etc.

* clang-tidy.sh: viewer-only headers (`viewer_utils.h`, `mesh_utils.hpp`)
  excluded — they need `WITH_VIEWER=ON` + system GLFW/libigl that the
  lint build doesn't drag in.

* `.codespellrc`: extended ignore list (recognise, signalled, modelled,
  travelled, …) for British-English consistency across own writing.

Final state — local quality block on this commit, this branch:

    ✅ License headers       (66/66 carry MIT SPDX)
    ✅ CGAL conventions      (0/6 violations on 6 CGAL headers)
    ✅ clang-format drift    (0 drift)
    ✅ cmake-format/-lint    (0 drift, 0 lint findings)
    ✅ codespell             (0 typos in scope)
    ✅ shellcheck            (0 findings across 16 .sh files)
    ✅ cppcheck              (warning+ severity clean)
    ✅ Markdown links        (122/122 resolve)
    ✅ Sanitizers (ASan+UBSan) (23/23 fast tests pass)
    ✅ clang-tidy             (35 headers inspected, 0 findings)

Library standalone-ness verified:
    env -i PATH=... cmake -S code -B /tmp/build-standalone
    cmake --build /tmp/build-standalone --target conformallab_tests
    ctest -E '^cgal\.'    →  all green

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/quality/clang-tidy.sh

@@ -40,20 +40,39 @@ TARGET_DIR="${1:-code/include}"
 [ -d "$TARGET_DIR" ] || { echo "FAIL: $TARGET_DIR is not a directory" >&2; exit 2; }
 
 # Generate compile_commands.json (clang-tidy needs it for include paths).
+# Enable WITH_CGAL_TESTS so the CGAL include directories are part of at
+# least one compile entry — clang-tidy walks those when linting headers
+# that don't appear in compile_commands.json directly.
 cmake -S code -B "$BUILD_DIR" \
     -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
+    -DWITH_CGAL_TESTS=ON \
     -DCMAKE_BUILD_TYPE=Release \
     -Wno-dev >/dev/null
 
+# ── macOS workaround: brew-installed clang-tidy doesn't know where the
+# Apple Command-Line-Tools SDK lives, so it can't find <cmath>, <complex>,
+# <CGAL/...>, etc.  Pass `--extra-arg=-isysroot ...` to teach it.
+EXTRA_ARGS=()
+if [ "$(uname -s)" = "Darwin" ]; then
+    SDK="$(xcrun --show-sdk-path 2>/dev/null || true)"
+    if [ -n "$SDK" ]; then
+        EXTRA_ARGS+=(--extra-arg=-isysroot --extra-arg="$SDK")
+    fi
+fi
+
 mkdir -p "$BUILD_DIR"
 : > "$LOG"
 
-# Find every .h / .hpp under TARGET_DIR (skip deps + macOS dup files).
+# Find every .h / .hpp under TARGET_DIR (skip deps + macOS dup files +
+# viewer-only headers — those need `-DWITH_VIEWER=ON` plus a system
+# GLFW/libigl that we don't drag into the lint build).
 HEADERS=$(find "$TARGET_DIR" \
     \( -name "*.h" -o -name "*.hpp" \) \
     -type f \
     | grep -v "code/deps/" \
     | grep -v " 2\." \
+    | grep -v "viewer_utils\.h$" \
+    | grep -v "mesh_utils\.hpp$" \
     | sort)
 
 echo "========================================"
@@ -72,6 +91,7 @@ for h in $HEADERS; do
     # generated" boilerplate.  Pipe through tee for the log file.
     clang-tidy --quiet \
         -p "$BUILD_DIR" \
+        "${EXTRA_ARGS[@]}" \
         "$h" 2>&1 | tee -a "$LOG" || true
 done