quality: 4 more gates + dependency audit; full --fast sweep 10/10 green

This commit closes the structural-tests work on PR #18.  Every gate
in `run-all.sh --fast` now passes end-to-end on the canonical dev
machine.

New gates
─────────
1. shellcheck (scripts/quality/shellcheck.sh)
   * Scans every `scripts/**/*.sh` at severity=warning+
   * 16 scripts inspected; cleanup pass took the tree from 7 findings
     (SC2164 + SC2034) to 0 findings.

2. cppcheck (scripts/quality/cppcheck.sh)
   * Complementary static analyser to clang-tidy; different heuristics,
     fewer false-positives on heavy CGAL/Eigen templates.
   * Default severity warning+, --strict adds style, --all = everything.
   * Suppresses 4 noise classes (missingIncludeSystem, etc.) explicitly.

3. .editorconfig
   * Cross-IDE fallback for editors that don't honour clang-format.
   * Covers Markdown (preserve trailing whitespace), Python, YAML,
     JSON, shell, Makefile (tabs) — the file types clang-format
     doesn't cover.

4. CONFORMALLAB_WARNINGS_AS_ERRORS CMake option
   * Off by default → regular builds don't break on new GCC warnings.
   * `-DCONFORMALLAB_WARNINGS_AS_ERRORS=ON` adds `-Werror`, intended for
     CI promotion-track and sanitizer runs.

Dependency audit  (doc/architecture/dependencies.md)
────────────────────────────────────────────────────
New single-source-of-truth document listing:
  * what the library requires (Eigen + CGAL + Boost — all header-only)
  * what tests require (auto-fetched GTest, no system install)
  * what each quality tool is for, install command per OS, and
    behaviour when missing (each gate exits 2 = SKIP, run-all
    recognises this and continues)
  * a verification recipe that strips PATH down and shows the
    library still configures + builds + tests cleanly with zero
    quality tools installed.

run-all.sh enhanced
───────────────────
* Recognises "tool not in PATH" → SKIP (not FAIL).
* Summary now reports `passed / skipped / failed` separately.

Bug fixes uncovered by the sweep
────────────────────────────────
* sanitizers.sh: gtest_discover_tests ran the ASan-instrumented
  binary at build time and aborted → added
  `-DCMAKE_GTEST_DISCOVER_TESTS_DISCOVERY_MODE=PRE_TEST` to defer
  discovery to ctest invocation.  Now 23/23 sanitizer-instrumented
  tests pass.

* clang-tidy.sh on macOS: brew-installed clang-tidy couldn't find
  Apple SDK system headers (<cmath>, <complex>, …) → added
  `--extra-arg=-isysroot $(xcrun --show-sdk-path)` on Darwin.

* clang-tidy.sh: needed `-DWITH_CGAL_TESTS=ON` in compile_commands
  generation so CGAL include paths are part of at least one
  compile entry.  Now resolves CGAL/Surface_mesh.h etc.

* clang-tidy.sh: viewer-only headers (`viewer_utils.h`, `mesh_utils.hpp`)
  excluded — they need `WITH_VIEWER=ON` + system GLFW/libigl that the
  lint build doesn't drag in.

* `.codespellrc`: extended ignore list (recognise, signalled, modelled,
  travelled, …) for British-English consistency across own writing.

Final state — local quality block on this commit, this branch:

    ✅ License headers       (66/66 carry MIT SPDX)
    ✅ CGAL conventions      (0/6 violations on 6 CGAL headers)
    ✅ clang-format drift    (0 drift)
    ✅ cmake-format/-lint    (0 drift, 0 lint findings)
    ✅ codespell             (0 typos in scope)
    ✅ shellcheck            (0 findings across 16 .sh files)
    ✅ cppcheck              (warning+ severity clean)
    ✅ Markdown links        (122/122 resolve)
    ✅ Sanitizers (ASan+UBSan) (23/23 fast tests pass)
    ✅ clang-tidy             (35 headers inspected, 0 findings)

Library standalone-ness verified:
    env -i PATH=... cmake -S code -B /tmp/build-standalone
    cmake --build /tmp/build-standalone --target conformallab_tests
    ctest -E '^cgal\.'    →  all green

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/quality/run-all.sh

@@ -28,7 +28,7 @@
 
 set -uo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$ROOT"
+cd "$ROOT" || exit 2
 
 FAST=0
 [ "${1:-}" = "--fast" ] && FAST=1
@@ -39,6 +39,8 @@ GATES_FAST=(
     "clang-format drift  | bash scripts/quality/clang-format.sh"
     "cmake-format/-lint  | bash scripts/quality/cmake-format.sh"
     "codespell           | bash scripts/quality/codespell.sh"
+    "shellcheck          | bash scripts/quality/shellcheck.sh"
+    "cppcheck            | bash scripts/quality/cppcheck.sh"
     "Markdown links      | python3 scripts/check-markdown-links.py"
     "Sanitizers          | bash scripts/quality/sanitizers.sh"
     "clang-tidy          | bash scripts/quality/clang-tidy.sh"
@@ -67,6 +69,7 @@ echo "============================================================"
 
 results=""
 failed=0
+skipped=0
 i=0
 for entry in "${GATES[@]}"; do
     i=$((i + 1))
@@ -79,12 +82,21 @@ for entry in "${GATES[@]}"; do
     log="$LOG_DIR/$slug.log"
     echo
     echo "──── [$i/${#GATES[@]}] $name  ────"
-    if eval "$cmd" >"$log" 2>&1; then
+    eval "$cmd" >"$log" 2>&1
+    rc=$?
+    # Exit code 2 from any of our gate scripts = "tool not installed".
+    # Treat as SKIP rather than FAIL so a partial dev environment can
+    # still run the rest of the sweep.
+    if [ "$rc" -eq 2 ] && head -3 "$log" | grep -qE "FAIL:.*not (in PATH|installed|found)"; then
+        echo "    SKIP   (tool not installed — see $log)"
+        results="${results}  SKIP  $name  (missing tool)
+"
+        skipped=$((skipped + 1))
+    elif [ "$rc" -eq 0 ]; then
         echo "    OK     ($log)"
         results="${results}  PASS  $name
 "
     else
-        rc=$?
         echo "    FAIL (rc=$rc) — see $log"
         echo "    last 20 lines:"
         tail -20 "$log" | sed 's/^/      /'
@@ -100,5 +112,7 @@ echo "  Summary"
 echo "============================================================"
 printf "%s" "$results"
 echo
-echo "  failed: $failed / ${#GATES[@]}"
+echo "  passed:  $((${#GATES[@]} - failed - skipped)) / ${#GATES[@]}"
+echo "  skipped: $skipped     (tool not installed; gate is local-only)"
+echo "  failed:  $failed"
 exit $failed