Summary

Adds a CI lint step that parses every "password-rules" value in quirks/password-rules.json using the existing tools/PasswordRulesParser.js. Any parse error is reported with the offending domain and the parser's error message, causing the password-rules lint job to fail.

This addresses #907, where a small formatting error (a comma instead of a semicolon between two required: properties for hetzner.com) landed without CI catching it and only surfaced later as a downstream parser exception.

The new check piggybacks on the existing password-rules job (sort-order check) and adds two steps: actions/setup-node@v6 and node .github/workflows/lint-scripts/password-rules-parse.js. No other lint behavior changes.

How it works

password-rules-parse.js loads tools/PasswordRulesParser.js via node:vm into a sandbox whose console.error is captured. It iterates every domain in password-rules.json, calls parsePasswordRules(), and exits non-zero if any rule produced a parser error. The parser is loaded unchanged — it remains usable by Safari/WebKit consumers that expect a plain script.

Test plan

• Run node .github/workflows/lint-scripts/password-rules-parse.js on main → OK: 419 password-rules entries parsed cleanly. (exit 0)
• Reintroduce the original hetzner.com comma typo from Improve password-rules.json error catching in CI #907 → script fails with 1 domain(s) in password-rules.json failed to parse. and identifies hetzner.com (exit 1)
• Restore correct value → clean again (exit 0)
• python -c "import yaml; yaml.safe_load(open('.github/workflows/lint.yml'))" → YAML valid

Risks / follow-ups

• The script only fails on console.error from the parser; recoverable warnings (e.g. the console.warn about a - inside a character class) are intentionally ignored to avoid noisy false positives. If desired, a follow-up could promote those to errors.
• This does not introduce any runtime dependencies — it uses only Node built-ins (fs, path, vm).