docs: restore CONTRIBUTING's reviewed lint guidance dropped by merge 89fa633

The grant-3 merge resolved the CONTRIBUTING.md conflict by taking main's whole
file, which dropped this branch's First free check lint section. This keeps
main's #3778 toolchain sentence (plus oxlint) and restores every other line
from 773964f byte for byte.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

CONTRIBUTING.md

@@ -24,15 +24,25 @@ bin/dev-setup                  # activate dev mode
 bun install --frozen-lockfile
 bun run typecheck        # expect no output and exit 0 (about a second)
 bun run typecheck:test   # expect "test typecheck ratchet: N known diagnostics, none new."
+bun run lint             # expect "lint ratchet: N known findings, none new (oxlint <version>)." (under a second)
 ```
 
 `typecheck` covers product code (`browse/src`, `lib`, `scripts`, `bin`, `hosts`, and the other
 entries in `tsconfig.json`) and must stay at zero errors. `typecheck:test` holds test code to the
 committed `scripts/typecheck-test-baseline.json`: a new or repeated diagnostic fails and names
 the file, TS code and message; fixing diagnostics also fails until you lock the smaller allowance
-in with `bun run typecheck:test --write-baseline`. Editing `lib/cso/*.ts`? Run
-`bun run format:cso` before committing; CI runs `format:cso:check`. All three run in the required
-`free-tests` check.
+in with `bun run typecheck:test --write-baseline`. `lint` runs oxlint's correctness rules
+(`.oxlintrc.json`) and holds existing findings to `scripts/lint-baseline.json` the same way: a new
+or repeated finding fails with `LINT_RATCHET_NEW` and its file, line and rule, and a fixed one fails
+with `LINT_RATCHET_FIXED` until `bun run lint --write-baseline` locks it in (that flag only
+shrinks the baseline). The baseline records the oxlint version, which must match `package.json`'s
+exact pin; after bumping oxlint, run `bun run lint --write-baseline --oxlint-upgrade` in the same
+change. Findings are keyed by file, so renaming or splitting a file moves its findings and they count as
+new: fix them, or mark an intended one with `// eslint-disable-next-line <rule> -- <reason>` (oxlint
+honors it, and /review lists it as a gate edit). oxlint
+picks files by extension, so the extensionless Bun scripts in `bin/` are not linted yet. Editing
+`lib/cso/*.ts`? Run `bun run format:cso` before committing; CI runs
+`format:cso:check`. All four run in the required `free-tests` check.
 
 Now edit any `SKILL.md`, invoke it in Claude Code (e.g. `/review`), and see your changes live. When you're done developing: