feat(M5): Final hardening, CI surface, and documentation closeout

docs/CLEANUP-BASELINE.md

@@ -3,10 +3,9 @@
 Captured: 2026-05-03 · Platform: macOS (arm64, Apple Silicon) · Node 22.14.0 · pnpm 10.18.1
 
 This document records the as-is state of every quality check at the start of
-the refactor series.  The transitional `pnpm run check` contract allows the
-aggregate check to exit non-zero **only** on issues listed here.  Any failure
-not covered by this document represents a regression introduced by a later
-milestone.
+the refactor series.  All pre-existing failures listed here have since been
+resolved.  As of M5 `pnpm run check` exits **0** on a clean checkout.  Any
+failure now represents a regression and must be fixed before merge.
 
 ---
 
@@ -471,3 +470,89 @@ Overall exit: **0** — all checks green (no regressions from M3).
 | `pnpm run test:installer` (root scripts) | 80 |
 | `atlassian/shared/scripts` | 29 |
 | **Total** | **109** |
+
+---
+
+## Final state (post-M5) — CLOSED
+
+Captured: 2026-05-03 · Platform: macOS 15 (arm64) · Node 22.14.0 · pnpm 10.18.1
+
+M5 added CI configuration, finalised documentation, closed out this baseline
+report, and locked in a permanently green `pnpm run check` gate.  No
+pre-existing failures remain open.
+
+### `pnpm run check` aggregate (post-M5 — macOS)
+
+```text
+PASS  lint
+PASS  typecheck
+PASS  test
+PASS  verify:pi
+PASS  verify:reviewers
+PASS  verify:docs
+PASS  verify:generated
+
+All checks passed.
+```
+
+Overall exit: **0** — all checks green (no regressions from M4).
+
+### What changed in M5
+
+- **S-501** — `.github/workflows/check.yml` added: matrix over `ubuntu-latest`
+  and `macos-latest`; installs `shellcheck` (apt/brew), `ripgrep` (apt), pnpm,
+  and Node.js 22; runs `pnpm run check`.
+- **S-501** — `.github/workflows/check-online.yml` added: weekly schedule +
+  `workflow_dispatch`; runs `verify:docs:online` for full external link checking.
+- **S-502** — Root `README.md` gained a "Contributing / Development" section
+  naming `pnpm run check` as the single quality gate and linking to
+  `docs/DEVELOPMENT.md`.
+- **S-503** — `docs/DEVELOPMENT.md` finalised: added "Adding a new agent",
+  "Adding a new skill", and "CI" sections; transitional contract replaced by
+  the permanent M5 contract; baseline links updated.
+- **S-504** — This file (`docs/CLEANUP-BASELINE.md`) closed out with the
+  "Final state" section.
+- **S-505** — Root `package.json` `files` list updated: `docs/DEVELOPMENT.md`
+  and `docs/REVIEWERS.md` added.
+- **S-506** — `CHANGELOG.md` extended with the M5 consolidated entry.
+- **S-507** — Final `pnpm run check` run confirmed green (output above).
+
+### Baseline status summary
+
+Every pre-existing failure recorded in this document is now **resolved**.
+No waivers are required.
+
+| Check | M1 status | Final status | Resolution |
+|-------|-----------|--------------|------------|
+| `lint` (ESLint) | FAIL — 2 errors | **PASS** | Fixed in M3 (S-302) |
+| `lint` (shellcheck) | FAIL — 7 findings | **PASS** | Fixed in M3 (S-302) |
+| `typecheck` | PASS | **PASS** | Never regressed |
+| `test` | PASS | **PASS** | Never regressed |
+| `verify:pi` | PASS | **PASS** | Portability hardened in M2 |
+| `verify:reviewers` | PASS | **PASS** | Never regressed |
+| `verify:docs` (markdownlint) | FAIL — 1160 errors | **PASS** | Fixed in M2 |
+| `verify:docs` (link-check) | PASS | **PASS** | Never regressed |
+| `verify:generated` | PASS (stub) | **PASS** | Real implementation in M3 |
+
+### Ubuntu smoke test
+
+The CI workflow (`.github/workflows/check.yml`) runs the same `pnpm run check`
+command on `ubuntu-latest`.  This replaces the Docker one-liner that was the
+only documented Ubuntu smoke test path in M1–M4.
+
+For local reproduction on Linux:
+
+```bash
+# Requires Docker
+docker run --rm \
+  -v "$PWD:/w" \
+  -w /w \
+  node:22-bookworm \
+  bash -lc 'apt-get update -q && apt-get install -y -q shellcheck ripgrep python3 \
+            && corepack enable \
+            && pnpm install --frozen-lockfile \
+            && pnpm run check'
+```
+
+*This baseline report is now closed.  Future regressions must be caught by CI
+and fixed before merge; they should NOT reopen this document.*