fix(ci): centralize markdownlint coverage

[mogul]

Summary

Standalone quickstart markdownlint fix, separated from #474 so every in-flight PR does not carry its own copy.

This applies the same centralization principle as GSA-TTS/agentic-coding-patterns#451 (one npm-pinned markdownlint dependency path for local hooks and CI), then includes the quickstart-specific issue found while resolving #474:

• replace markdownlint-cli2 with markdownlint-cli from .github/linters/package-lock.json;
• move rule config to .markdownlint.jsonc and file exclusions to .markdownlintignore;
• pass --dot everywhere, so .github/**/*.md is actually linted;
• make the CI non-empty assertion use git's gitignore engine instead of hand-translating ignore patterns into pathspecs.

Why separate

#474 and stacked PRs currently touch the same markdownlint files while also changing unrelated backend behavior. Landing this first lets those branches drop their local markdownlint copy and focus reviews on their feature changes.

Verification

• npm ci --prefix .github/linters passed.
• npm run lint:md passed.
• npm audit --prefix .github/linters --audit-level=high passed, 0 vulnerabilities.
• YAML/JSON parse check passed for .pre-commit-config.yaml, .markdownlint-cli2.yaml, package.json, and .github/linters/package.json.
• git diff --cached --check passed before commit.
• Selection parity probe passed: workflow count = 53; markdownlint custom always-report rule selected 53 files.

Rollback

Revert this PR to restore the current markdownlint-cli2 config path.

Security Impact

No application runtime impact. Supply-chain posture is unchanged in shape: linter dependency remains pinned through .github/linters/package-lock.json and audited in CI.

AI-assisted. Human review required.

[wz-gsa]

Independently re-verified in an isolated worktree before approving — not just trusting the PR's own transcript.

Core security fix confirmed:

• npm ci && npm audit --audit-level=high: 0 vulnerabilities in a fresh install (markdownlint-cli2 → markdownlint-cli@0.49.1 removes the entire braces/micromatch/globby/fast-glob chain that GHSA-vfj7-8cjw-p6xm sits in, with no patched upstream release available).
• Full lint run with the PR's real invocation (--config .markdownlint.jsonc --ignore-path .markdownlintignore --dot "**/*.md"): clean, exit 0.
• File-count parity cross-checked via git ls-files: 54 tracked .md files, 1 ignored (CHANGELOG.md), 53 expected — exact match to the real tool's own count.

Adversarially stress-tested the --dot claim specifically (rather than taking the commit message at face value), since this is exactly the kind of flag-default difference that silently narrows lint coverage if gotten wrong:

• Injected a real violation (MD012 multiple-blanks) into .github/pull_request_template.md.
• Old markdownlint-cli2@0.23.3's actual CI invocation (no CLI glob args, config-only): catches it — cli2 already includes dot-directories by default.
• New markdownlint-cli, without --dot: misses it silently, exit 0.
• New markdownlint-cli, with --dot (as this PR ships): catches it correctly, exit 1.

One nuance worth flagging for the record: this means --dot here is avoiding a regression the tool swap would otherwise introduce (different tool, different default), rather than fixing a pre-existing gap in the old tool as the commit message's phrasing could be read — the old markdownlint-cli2 already covered this file. Doesn't change the verdict; the PR correctly includes --dot everywhere it's needed, I just want that distinction on record.

Also verified the gitignore-engine point in the PR's own commit message: confirmed git ls-files --exclude-from=.markdownlintignore genuinely gives different results from a naive pathspec translation for directory-shaped excludes like test/vendor — using git's real gitignore semantics for the CI "did we lint anything" assertion is the right call, not just defensive-sounding prose.

Nice, clean separation from the stacked #474/#541 branches too — this unblocks the shared CI failure without entangling it in unrelated feature review.

Approving. CI is green except one job that self-cancelled from a concurrency-group race (same pattern I hit on patterns#471 today, unrelated to this change) — re-triggered via gh run rerun, waiting on it before merge.