CI install fails with 401 on the private @taskade/eslint-plugin #29

Problem

The build-and-test CI job fails at yarn install --frozen-lockfile on master and on every pull request. The job stops before the build and the tests run.

Live signal

• The last CI run on master (run 28550031542, 2026-07-01) failed.
• Dependabot PRs chore(deps): bump the npm_and_yarn group across 2 directories with 10 updates #24 and chore(deps): bump the npm_and_yarn group across 2 directories with 9 updates #25 (2026-09-10) failed at the install step.
• PR fix(auth): Send client credentials on the Zapier token refresh #28 (2026-10-07, run 37703714770) failed at the install step with this log line:

error Error: https://npm.pkg.github.com/download/@taskade/eslint-plugin/0.4.0/d476accb3162a305a52faa59e35d3b9c1ce4b099: Request failed "401 Unauthorized"

Root cause

package.json lists the private package @taskade/eslint-plugin in dependencies. GitHub Packages serves it only to accounts with access to the taskade organization. The public CI runner and external contributors get a 401, so nobody outside the organization can install this public repo.

The package was lint-only. The repo has no lint script, and CI does not run lint. It was also in dependencies, so zapier push bundled it with the app.

PR #20 had a fix for this. It was closed and folded into PR #19, which also changes the task_due trigger and the README. PR #19 is still open, so master is still red.

Fix plan

1. Remove @taskade/eslint-plugin. Prune its tree from yarn.lock.
2. Add eslint and @typescript-eslint as public devDependencies, at the versions that the lockfile already holds.
3. Replace .eslintrc.json with a self-contained config. Keep the core rules of the old plugin that need only public packages.
4. Add a lint script and a CI lint step.
5. Correct the README: add a platform status table and the current list of Zapier operations.