style(plugin-kit): adopt the biome config its own plugins already use

The kit had NO biome config and no lint script, while every plugin repo that
consumes it has both. So its source quietly drifted — unused imports, unsorted
imports, formatting — with nothing to catch any of it. Running biome here for
the first time reported 20 findings across 8 files.

Adds `plugin-kit/biome.json` mirroring the plugin repos' (tab indent, double
quotes, recommended lint preset, organizeImports), a `check` script, and
`@biomejs/biome` pinned to the same `^2.5.2` the plugins pin — without that pin
`bunx biome` resolved 2.4.6, which rejects the 2.5 `rules.preset` key.

Two deliberate differences from the plugin repos' copy:

  * no `vcs.useIgnoreFile` — those are standalone repos with a .gitignore beside
    the config; plugin-kit is a directory inside this one, and biome errors with
    "couldn't find an ignore file". The `files.includes` exclusions cover it.
  * `!examples/**/dist` instead of `!ui/dist` — the kit has examples, not a UI.

`css.parser.tailwindDirectives` is carried over and is load-bearing: without it
biome cannot parse `@theme` in src/theme.css and reports three parse errors on
CSS that is perfectly valid Tailwind v4.

Everything here is formatter/import churn except two real findings, both fixed:

  * `Layer` (library/define.ts) and `Cause` (sync-engine.ts) were imported and
    never used;
  * test/spike-httpapi.test.ts read `(reg?.body as …).ui.secret` one line after
    `expect(reg).toBeDefined()`. The optional chain undoes the assertion: had
    `reg` been undefined the `.ui` access would throw a TypeError instead of
    failing the test readably. Now asserted to the type system too.

Wired into plugin-kit-publish.yml as a `Lint & format` step ahead of Typecheck,
so this cannot rot again.

Gates after: biome clean (42 files), tsc clean, 67/67 tests, build clean.

plugin-kit/src/library/define.ts

@@ -6,12 +6,13 @@
 // appending launcher entries, serving `__config` so the console renders settings without the plugin
 // shipping an SPA, registering under `category: "library"` so it stays out of the nav, and the
 // standard CLI verbs.
-import type { PluginDef } from "@punktfunk/host";
+
 import * as fs from "node:fs";
-import { Duration, Effect, Layer, Schema, Stream } from "effect";
+import type { PluginDef } from "@punktfunk/host";
+import { Duration, Effect, type Schema, Stream } from "effect";
 import { type CliCommand, runPluginCli } from "../cli.js";
 import { type ConfigService, makeConfigService } from "../config.js";
-import { HostClient, PluginInfo } from "../host-client.js";
+import { HostClient, type PluginInfo } from "../host-client.js";
 import { ProviderClient, type ProviderClientService } from "../reconcile.js";
 import { definePluginKit, type PluginKitDef } from "../runtime.js";
 import { makeSyncEngine } from "../sync-engine.js";
@@ -103,8 +104,11 @@ export const defineLibraryPlugin = <S extends Schema.Top>(
 	const debounce = def.debounce ?? Duration.seconds(3);
 
 	/** The config service, built fresh wherever it is needed (it only requires `PluginInfo`). */
-	const config: Effect.Effect<ConfigService<S>, never, PluginInfo> =
-		makeConfigService({ schema: def.configSchema });
+	const config: Effect.Effect<
+		ConfigService<S>,
+		never,
+		PluginInfo
+	> = makeConfigService({ schema: def.configSchema });
 
 	/** Scan + launcher entries, in the order they should reach the host. */
 	const computeEntries = (
@@ -234,7 +238,8 @@ export const defineLibraryPlugin = <S extends Schema.Top>(
 				}),
 		},
 		scan: {
-			summary: "scan and print what WOULD be synced (--preview for the JSON entries)",
+			summary:
+				"scan and print what WOULD be synced (--preview for the JSON entries)",
 			// Also offline: the point is to debug a scanner against real launcher files without
 			// touching the host's library.
 			offline: true,
@@ -289,9 +294,9 @@ export const defineLibraryPlugin = <S extends Schema.Top>(
 					}
 					const baseline = yield* Effect.try({
 						try: () =>
-							JSON.parse(fs.readFileSync(compare as string, "utf8")) as ReturnType<
-								typeof fromHostEntry
-							>[],
+							JSON.parse(
+								fs.readFileSync(compare as string, "utf8"),
+							) as ReturnType<typeof fromHostEntry>[],
 						catch: (cause) => new Error(`cannot read ${compare}: ${cause}`),
 					});
 					const cfg = yield* (yield* config).load;
@@ -307,7 +312,8 @@ export const defineLibraryPlugin = <S extends Schema.Top>(
 				}),
 		},
 		uninstall: {
-			summary: "remove this source's games from the host and release its store claim",
+			summary:
+				"remove this source's games from the host and release its store claim",
 			run: () =>
 				Effect.gen(function* () {
 					const provider = yield* ProviderClient;

plugin-kit/src/library/parsers/art.ts

@@ -36,7 +36,10 @@ export const fileUrl = (p: string): string => {
  * re-hashed; newer ones serve from an unpredictable per-asset-hash path, where this 404s and the
  * client falls through to its next candidate. That degradation is intentional and pre-existing.
  */
-export const steamCdnUrl = (appid: number, kind: ArtKind): string | undefined => {
+export const steamCdnUrl = (
+	appid: number,
+	kind: ArtKind,
+): string | undefined => {
 	// A non-Steam shortcut's appid has the high bit set and is never a real store appid — the CDN
 	// would only 404, so don't emit a URL that is guaranteed to fail.
 	if ((appid & 0x8000_0000) !== 0) return undefined;
@@ -81,7 +84,12 @@ export const findLocalArtFile = (
 	}
 	// Older Steam wrote the files directly under `librarycache/` with the appid in the name.
 	for (const name of localFilenames(kind)) {
-		const flat = path.join(root, "appcache", "librarycache", `${appid}_${name}`);
+		const flat = path.join(
+			root,
+			"appcache",
+			"librarycache",
+			`${appid}_${name}`,
+		);
 		if (isFile(flat)) return flat;
 	}
 	return undefined;

plugin-kit/src/library/parsers/fs.ts

@@ -101,7 +101,7 @@ export const confinedJoin = (base: string, rel: string): string | undefined => {
 	// Normalize separators so a Windows-shaped relative path is checked on any platform (a plugin
 	// may parse a Windows manifest while its tests run on Linux).
 	const parts = rel.split(/[\\/]/);
-	if (parts[0] === "" ) return undefined; // rooted
+	if (parts[0] === "") return undefined; // rooted
 	if (/^[A-Za-z]:$/.test(parts[0])) return undefined; // drive prefix
 	if (parts.some((p) => p === "..")) return undefined; // traversal
 	const joined = path.join(base, ...parts.filter((p) => p !== "" && p !== "."));

plugin-kit/src/library/parsers/http.ts

@@ -6,8 +6,9 @@
 // SSRF pivot from a process running on the operator's box (`http://169.254.169.254/…`, an internal
 // service). The host learned this in the 2026-07-17 security review; a plugin fetching the same
 // class of URL inherits the same rule. A rare legitimately-redirecting CDN just yields no art.
-import { HostRequestError } from "../../errors.js";
+
 import { Effect } from "effect";
+import { HostRequestError } from "../../errors.js";
 
 export interface FetchLimits {
 	/** Hard cap on the response body. Default 8 MiB — a cover never approaches it. */

plugin-kit/src/library/parsers/shortcuts.ts

@@ -40,7 +40,10 @@ const readCStr = (buf: Uint8Array, c: Cursor): string | undefined => {
 /** Read a little-endian int32, advancing 4 bytes. `undefined` if fewer than 4 remain. */
 const readI32 = (buf: Uint8Array, c: Cursor): number | undefined => {
 	if (c.pos + 4 > buf.length) return undefined;
-	const v = new DataView(buf.buffer, buf.byteOffset + c.pos, 4).getInt32(0, true);
+	const v = new DataView(buf.buffer, buf.byteOffset + c.pos, 4).getInt32(
+		0,
+		true,
+	);
 	c.pos += 4;
 	return v;
 };
@@ -134,7 +137,7 @@ export const crc32 = (data: Uint8Array): number => {
 			crc = (crc >>> 1) ^ (0xedb8_8320 & mask);
 		}
 	}
-	return (~crc) >>> 0;
+	return ~crc >>> 0;
 };
 
 /**