📝 Move knip + outdated to a maintain: prefix

`npm run check` should be the fast, offline correctness ladder only (tsc +
oxlint + oxfmt + cspell, ~3s), so an agent can run it as a confirmation gate
during feature work. check:knip / check:outdated were advisory whole-project /
network scans, and check-outdated exits non-zero whenever any dep is behind.
Keeping them in check made `npm run check` (and the CI build gate) fail on
dependency freshness, which must not block an unrelated feature PR.

Rename them to maintain:knip / maintain:outdated, aggregate under `npm run
maintain`, and run it in CI as a dedicated non-blocking job (continue-on-error)
that surfaces findings without ever gating a merge. Update the script-prefix
convention, the feedback-tier table, and AGENTS.md: the agent may now run
`npm run check`; only `maintain` stays out of the feature loop.

.github/workflows/ci.yml

@@ -26,6 +26,21 @@ jobs:
                   name: coverage
                   path: coverage
 
+    # Advisory scans (dead code, dependency freshness). Non-blocking: surfaced on
+    # the PR for visibility, but must never gate a merge — so continue-on-error and
+    # intentionally NOT in `publish`'s `needs`.
+    maintain:
+        runs-on: ubuntu-latest
+        continue-on-error: true
+        steps:
+            - uses: actions/checkout@v4
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: .node-version
+                  cache: "npm"
+            - run: npm ci
+            - run: npm run maintain
+
     publish:
         if: startsWith(github.ref, 'refs/tags/')
         needs: build