Build tooling work, commits C1 through C25b,c,d.

[KubaO]

• Add the tooling review's commit plan (builder/PLAN-TOOLING-REVIEW.md) and keep it, and WIP.md's sample counts, current as commits land.
• State the dependency pinning policy; correct Builder.md's dependency list.
• Add compare_trees.mjs: builds HEAD and the working tree in two worktrees and compares all three output trees byte for byte.
• Add check_ci_workflows.mjs: both CI workflows must run every wrapper gate, with the same arguments and order.
• CI: one composite action (.github/actions/run-gates) runs the gates for both workflows.
• Add Biome (correctness rules only) and fix what it found.
• Update js-yaml, ws, linkify-it and immutable past their security advisories.
• Add check_lint.mjs, a lint gate in test.bat and CI that also fails on warnings.
• convert_em_dash_separators exits 2 on a crash.
• Add a pre-commit hook in .githooks/ that runs Biome on staged scripts (git config core.hooksPath .githooks).
• Declare picocolors and pako, which the code imports directly.
• Move census_attributes.mjs from builder/ to scripts/; it finds the IDE through tb-install.
• Move markdown-files.mjs to a new top-level lib/, so builder/ can use it.
• serve.mjs and eval/ decide what is a build output tree with the shared isOutputTree.
• Delete dead code: the retired diff tools' leftovers, precomputeSeo, schemas.mjs and COUNT_NAMES; unexport kramdownSlug.
• tbdocs refuses a --dest that overlaps the source tree.
• tbrun recognises all five failed-build shapes instead of returning the build log as the probe's output.
• Harness command lines refuse a flag given without its value; tbbuild no longer takes a flag's value for the project.
• A command-line error in tbdocs and check_links.mjs exits 4, outside the 1/2/3 link bitmask.
• Docs: correct render.mjs's export table and plugin chain; add export tables for counts.mjs and page-baseline.mjs.
• Browser tools share scripts/lib/browser.mjs, which closes the browser and removes its temp profile on every exit path.
• The a11y tools validate --theme and --viewport wherever a matrix is built.
• New build gate: the Gantt chart draws every task, or the build fails naming the task.
• crawl_check: follows every link attribute the build checks; sets its exit code instead of calling process.exit, which could abort on Windows; retries twice a request that fails before any response; reports a page whose body cannot be read; --timeout now covers the body.
• serve.bat redirects a folder URL to its trailing-slash form, as GitHub Pages does.
• Builder.md's and Pipeline-Stages.md's task sections match the Gantt chart and task graph; tbdocs.mjs's task-graph comment points to TASKS instead of restating it.
• check_examples restores the registry and exits 2 when spawning a lane fails.
• tb-operate throws if the IDE is still revealing lines at its timeout, instead of placing the cursor anyway.
• tbbuild tidies the registry even when the IDE launch fails; correct a comment in tb-registry.mjs.
• tbbuild refuses a named IDE that does not exist.
• tb-launch.ps1 reports a failed launch as one plain line with the right Windows error, instead of PowerShell's XML.
• launchIde --show reports a failed start with exit 2 instead of crashing with exit 1.
• known issue: the searchData and symbolIndex tasks should be overlapped with write[Aux|Offline|Pdf].