test(01-02): add CORE-10 firewall test + violator fixture

- src/sim/__test_violation__/violator.ts deliberately imports from
  src/render/__firewall_target__.ts to trigger the firewall rule.
- src/sim/__test_violation__/lint-firewall.test.ts runs ESLint
  programmatically (with ignore: false) against the violator and
  asserts boundaries/element-types fires with severity=error and the
  message mentions both 'sim' and 'render'.
- src/render/__firewall_target__.ts is a minimal export so the
  boundaries plugin can resolve the import to a real path on disk.
  Without a real target, the plugin marks the import as isUnknown
  and silently skips the rule (verified empirically; see SUMMARY).
- eslint.config.js gains an import/resolver: typescript block so the
  TS-aware resolver follows extension-less imports
  ('../../render/foo' -> src/render/foo.ts). Required by the
  boundaries plugin's element classification of import targets.
- tsconfig.app.json excludes *.test.ts and src/sim/__test_violation__/
  so 'tsc -b' does not try to typecheck Node-API-using test code with
  the DOM-only project's lib settings; vitest still discovers them
  via its own include glob.
- Added eslint-import-resolver-typescript as devDep.

Verifies green:
  npm run lint        -> 0 errors, 0 warnings (violator excluded)
  npm test            -> 2/2 pass (sentinel + firewall)
  npm run build       -> tsc -b clean, vite build clean
  npx eslint --no-ignore src/sim/__test_violation__/violator.ts
                      -> exits 1 with the expected
                         boundaries/element-types error

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

eslint.config.js

@@ -93,6 +93,24 @@ export default [
       // src/__sentinel__.test.ts). The firewall rule only fires on
       // sim → {render, ui} edges; unclassified files don't trigger it.
       'boundaries/ignore': ['src/vite-env.d.ts', 'src/__sentinel__.test.ts'],
+      // eslint-plugin-boundaries needs to RESOLVE import paths to disk
+      // files in order to classify the import target's element type.
+      // Without a TS-aware resolver, `import x from '../../render/foo'`
+      // (no extension) cannot be resolved to `src/render/foo.ts` and
+      // the target is marked `isUnknown`, silently skipping the rule.
+      // eslint-import-resolver-typescript reads tsconfig.json to follow
+      // bare-extension TS imports.  Verified empirically during Plan 02
+      // execution; see 01-02-SUMMARY.md "Deviations" (Rule 1 — Bug fix).
+      'import/resolver': {
+        typescript: {
+          alwaysTryTypes: true,
+          project: ['./tsconfig.app.json', './tsconfig.node.json'],
+          // Suppress "Multiple projects found" noise — we deliberately
+          // use the referenced-projects tsconfig layout (root tsconfig
+          // with `references`) per Plan 01.
+          noWarnOnMultipleProjects: true,
+        },
+      },
     },
     rules: {
       // CORE-10: the simulation core cannot reach into render or UI.