fix(lint): flag static composition hosts without opt-out

[QiuLsG]

What

• Extend missing_data_no_timeline to report each bare nested data-composition-id host without a matching timeline, explicit opt-out, or sub-composition source.
• Recognize bracket, dot, and object-literal timeline registrations while ignoring comment-only matches and conservatively skipping computed keys or external scripts.
• Document that every composition id participates in timeline readiness.

Why

Static nested hosts also participate in renderer readiness. Without a timeline or data-no-timeline, rendering waits for the player-ready timeout, but the existing lint rule only diagnosed the root composition.

How

The existing rule now compares every authored composition id with statically extractable timeline registry keys and emits one actionable warning per unresolved host. Real sub-composition mounts, inert templates, explicit opt-outs, and registrations that cannot be safely analyzed remain exempt.

Test plan

• Unit tests added/updated (@hyperframes/lint: 612 passed)
• Project lint integration test
• Typecheck and package build
• bun run build
• bun run lint
• Documentation updated

Full bun run test was also attempted on Windows. It reports unrelated platform/concurrency-sensitive failures involving symlink permissions, path separators, and timeouts; the lint package passes.

Closes #3743