ci(1b): add lint stage to .drone.yml push pipeline — enforces format/lint on every commit (RL1)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.drone.yml

@@ -14,6 +14,15 @@ trigger:
     - push
 
 steps:
+  # Lint/format gate (Phase 1b, RL1). Runs the exact toolchain from the pinned `lint` devshell
+  # (flake.nix) via scripts/lint.sh in check mode — FAILS the build on any unclean file so future
+  # commits stay formatted + lint-clean. HOME=/root so nix reuses root's store/eval cache.
+  - name: lint
+    environment:
+      HOME: /root
+    commands:
+      - nix develop .#lint --command bash scripts/lint.sh
+
   - name: hello
     commands:
       - echo "cc-ci self-test on the exec runner"