ci: add oxlint correctness check and resolve its findings (#592)

* refactor: resolve oxlint correctness findings without behavior changes

- Snapshot iterations that mutate their collection with Array.from()
  instead of a spread (live childNodes, self-removing disposers, a Set
  extended inside its own loop).
- Drop empty spread fallbacks, redundant regex escapes, Boolean() casts
  inside negations, a rethrow-only try/catch and statement ternaries.
- Use startsWith/endsWith for anchored literal checks in the extension.
- List U+FE0F explicitly in the mobile attachment emoji class; the
  matched set is unchanged.
- Fix the WeChat copy fixture, where \oint in a template literal lost its
  backslash and the block formula never exercised \oint.
- Document the intentional control-character regexes (filename
  sanitizing and input validation), the throwing provider stream test,
  Astro's generated type reference and the mobile auto-sync finally
  block with narrow inline exceptions.

* ci: run oxlint correctness rules on pull requests

Pin oxlint 1.88.0 and enable only its correctness category across apps/
and packages/, excluding build output, vendored code and the iOS app.
Findings are errors and the script passes --deny-warnings, so CI fails
on any finding. no-unused-vars stays off until unused code is removed
in a dedicated pass.

.github/workflows/test.yml

@@ -1,6 +1,6 @@
 name: Test
 
-# Runs the non-E2E regression suite, type checks and the web build for every
+# Runs the non-E2E regression suite, lint, type checks and the web build for every
 # pull request and every push to main, so failures surface before a release
 # instead of in the release workflow.
 on:
@@ -52,6 +52,9 @@ jobs:
             sleep "$((15 * attempt))"
           done
 
+      - name: Lint
+        run: bun run lint
+
       - name: Type check
         run: bun run typecheck