quality: 4 more gates + dependency audit; full --fast sweep 10/10 green

This commit closes the structural-tests work on PR #18.  Every gate
in `run-all.sh --fast` now passes end-to-end on the canonical dev
machine.

New gates
─────────
1. shellcheck (scripts/quality/shellcheck.sh)
   * Scans every `scripts/**/*.sh` at severity=warning+
   * 16 scripts inspected; cleanup pass took the tree from 7 findings
     (SC2164 + SC2034) to 0 findings.

2. cppcheck (scripts/quality/cppcheck.sh)
   * Complementary static analyser to clang-tidy; different heuristics,
     fewer false-positives on heavy CGAL/Eigen templates.
   * Default severity warning+, --strict adds style, --all = everything.
   * Suppresses 4 noise classes (missingIncludeSystem, etc.) explicitly.

3. .editorconfig
   * Cross-IDE fallback for editors that don't honour clang-format.
   * Covers Markdown (preserve trailing whitespace), Python, YAML,
     JSON, shell, Makefile (tabs) — the file types clang-format
     doesn't cover.

4. CONFORMALLAB_WARNINGS_AS_ERRORS CMake option
   * Off by default → regular builds don't break on new GCC warnings.
   * `-DCONFORMALLAB_WARNINGS_AS_ERRORS=ON` adds `-Werror`, intended for
     CI promotion-track and sanitizer runs.

Dependency audit  (doc/architecture/dependencies.md)
────────────────────────────────────────────────────
New single-source-of-truth document listing:
  * what the library requires (Eigen + CGAL + Boost — all header-only)
  * what tests require (auto-fetched GTest, no system install)
  * what each quality tool is for, install command per OS, and
    behaviour when missing (each gate exits 2 = SKIP, run-all
    recognises this and continues)
  * a verification recipe that strips PATH down and shows the
    library still configures + builds + tests cleanly with zero
    quality tools installed.

run-all.sh enhanced
───────────────────
* Recognises "tool not in PATH" → SKIP (not FAIL).
* Summary now reports `passed / skipped / failed` separately.

Bug fixes uncovered by the sweep
────────────────────────────────
* sanitizers.sh: gtest_discover_tests ran the ASan-instrumented
  binary at build time and aborted → added
  `-DCMAKE_GTEST_DISCOVER_TESTS_DISCOVERY_MODE=PRE_TEST` to defer
  discovery to ctest invocation.  Now 23/23 sanitizer-instrumented
  tests pass.

* clang-tidy.sh on macOS: brew-installed clang-tidy couldn't find
  Apple SDK system headers (<cmath>, <complex>, …) → added
  `--extra-arg=-isysroot $(xcrun --show-sdk-path)` on Darwin.

* clang-tidy.sh: needed `-DWITH_CGAL_TESTS=ON` in compile_commands
  generation so CGAL include paths are part of at least one
  compile entry.  Now resolves CGAL/Surface_mesh.h etc.

* clang-tidy.sh: viewer-only headers (`viewer_utils.h`, `mesh_utils.hpp`)
  excluded — they need `WITH_VIEWER=ON` + system GLFW/libigl that the
  lint build doesn't drag in.

* `.codespellrc`: extended ignore list (recognise, signalled, modelled,
  travelled, …) for British-English consistency across own writing.

Final state — local quality block on this commit, this branch:

    ✅ License headers       (66/66 carry MIT SPDX)
    ✅ CGAL conventions      (0/6 violations on 6 CGAL headers)
    ✅ clang-format drift    (0 drift)
    ✅ cmake-format/-lint    (0 drift, 0 lint findings)
    ✅ codespell             (0 typos in scope)
    ✅ shellcheck            (0 findings across 16 .sh files)
    ✅ cppcheck              (warning+ severity clean)
    ✅ Markdown links        (122/122 resolve)
    ✅ Sanitizers (ASan+UBSan) (23/23 fast tests pass)
    ✅ clang-tidy             (35 headers inspected, 0 findings)

Library standalone-ness verified:
    env -i PATH=... cmake -S code -B /tmp/build-standalone
    cmake --build /tmp/build-standalone --target conformallab_tests
    ctest -E '^cgal\.'    →  all green

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/quality/cppcheck.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# scripts/quality/cppcheck.sh
+#
+# Run cppcheck over the public headers.  Complementary to clang-tidy:
+# cppcheck has different heuristics, fewer false-positives on heavy
+# template code (CGAL/Eigen), and catches some bugs (unused includes,
+# memory leaks in detail/) that clang-tidy is bad at.
+#
+# Local-only.  Promotion to CI when the existing tree is finding-free
+# at the chosen severity level.
+#
+# Usage:
+#   bash scripts/quality/cppcheck.sh           # error+warning only
+#   bash scripts/quality/cppcheck.sh --strict  # +style, exit 1 on any
+#   bash scripts/quality/cppcheck.sh --all     # absolute everything,
+#                                                useful for diffs only
+#
+# Exit codes:
+#   0  no findings at the chosen severity, or findings but not --strict
+#   1  findings + --strict
+#   2  prerequisite missing
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT" || exit 2
+
+command -v cppcheck >/dev/null 2>&1 || {
+    echo "FAIL: cppcheck not in PATH." >&2
+    echo "        macOS: brew install cppcheck" >&2
+    echo "        Linux: sudo apt install cppcheck" >&2
+    exit 2
+}
+
+STRICT=0
+ALL=0
+for arg in "$@"; do
+    case "$arg" in
+        --strict) STRICT=1 ;;
+        --all)    ALL=1 ;;
+        *) echo "Unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+ENABLE="warning"
+if [ "$STRICT" -eq 1 ]; then ENABLE="warning,style"; fi
+if [ "$ALL"    -eq 1 ]; then ENABLE="all"; fi
+
+BUILD_DIR="build-cppcheck"
+LOG="$BUILD_DIR/cppcheck.log"
+mkdir -p "$BUILD_DIR"
+
+echo "cppcheck ($(cppcheck --version 2>&1 | head -1))"
+echo "  enable:  $ENABLE"
+echo "  log:     $LOG"
+echo
+
+# Suppress noise classes that are not actionable in our project:
+#   missingIncludeSystem — CGAL/Eigen/Boost headers are intentionally
+#                          included implicitly; cppcheck cannot resolve.
+#   unmatchedSuppression — cosmetic.
+#   unusedFunction       — header-only; many `inline` helpers ARE used,
+#                          cppcheck can't see across TUs.
+#   normalCheckLevelMaxBranches — informational, not a finding.
+#
+# We point cppcheck at code/include/ only.  The deps tree is third-party
+# code and out of scope.
+
+cppcheck \
+    --enable="$ENABLE" \
+    --std=c++17 \
+    --quiet \
+    --error-exitcode=2 \
+    --inline-suppr \
+    --suppress=missingIncludeSystem \
+    --suppress=unmatchedSuppression \
+    --suppress=unusedFunction \
+    --suppress=normalCheckLevelMaxBranches \
+    -I code/include \
+    code/include 2>&1 | tee "$LOG"
+rc=$?
+
+echo
+echo "── Summary ──"
+n=$(grep -cE "\[(error|warning|style|performance|portability)\]" "$LOG" || true)
+echo "  total findings: $n"
+echo "  full log:       $LOG"
+
+if [ "$STRICT" -eq 1 ] && [ "$n" -gt 0 ]; then
+    exit 1
+fi
+if [ "$rc" -eq 2 ] && [ "$STRICT" -ne 1 ]; then
+    # cppcheck signalled "error" severity but caller didn't ask --strict.
+    echo
+    echo "NOTE: cppcheck reported an `error`-severity finding.  Even"
+    echo "      without --strict, please review the log."
+fi
+exit 0