fix(biome): move file scope out of the shared base (v1.0.1)

[kyle-sexton]

Summary

Found while converting medley (the Layer-1 pilot consumer) to @melodic-software/biome-config: Biome unions files.includes across extends — verified empirically, not documented prominently — so the base's ["**", "!**/packages.lock.json"] overrode medley's deliberately narrow files.includes and widened its scan to every JSON file in the repo (17 spurious formatter findings).

File scope is per-repo policy, not shared ruleset:

• modules/typescript/biome.json (the package's staged source) ships no files block.
• The NuGet-lockfile exclusion moves to this repo's root biome.jsonc stub — the layer that actually scans fixtures/dotnet (where packages.lock.json lives, from feat(dotnet): enable NuGet lock files in the overlay #59) — with the rationale recorded at both sites.
• Package bumped to 1.0.1 (publish fires on merge; the drift tripwire would otherwise fail the next run, by design).
• Package README documents the consumer contract: own your files block.

Verification

• Stub layer: biome check fixtures/dotnet/ → 0 files processed (exclusion intact).
• Module alone (negative test): processes fixtures/dotnet/bad/packages.lock.json and reports a format diff — proving the stub is now the excluding layer.
• fixtures/typescript/good clean under the module config (CI lane path).
• markdownlint clean.

The medley conversion PR follows, pinned to 1.0.1.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GbDWhcUtduCejgi7mcbMfy

---

Note

Low Risk
Config packaging and documentation only; no runtime or security logic—consumers must add their own files block when upgrading.

Overview
Fixes shared Biome config so consumers can define their own scan scope without Biome unioning files.includes from extends and widening lint/format to extra files (e.g. all JSON in medley).

modules/typescript/biome.json no longer ships a files block—only linter/formatter rules stay in the shared SSOT. biome.jsonc at the repo root now owns files.includes with !**/packages.lock.json for this repo’s dotnet fixtures, with comments explaining why scope is per-repo.

@melodic-software/biome-config is bumped to 1.0.1; the README documents that extenders must define their own files block.

^{Reviewed by Cursor Bugbot for commit 7602bd2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude finished @kyle-sexton's task in 0s —— View job

---

I'll analyze this and get back to you.

[cursor]

Risk: low. Cursor Bugbot completed successfully with no findings requiring human review. Approved; no reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}