ci: split typecheck into its own PR-checks job (#1599)

The Typecheck step lived inside the smoke-and-tests job and
typecheck:type-tests ran inside `bun run check`, so type errors were
buried mid-job and serialized behind the build. They now run as a
dedicated parallel `typecheck` job (tsc --noEmit + the focused type
tests) with its own status check, and `check` slims to
smoke + test:full so nothing runs twice in CI. Local scripts
(typecheck, typecheck:type-tests, hardening:strict) are unchanged.

Review feedback: the new job's checkout sets
persist-credentials: false (no credentials needed), and
CONTRIBUTING.md now documents typecheck as a CI-enforced check
instead of a recommended-local-only one.

Validation: workflow YAML parses (jobs: smoke-and-tests, typecheck,
web); typecheck exit 0; type-tests green; `bun run check` green.

Co-authored-by: OpenClaude <openclaude@gitlawb.com>

.github/workflows/pr-checks.yml

@@ -42,9 +42,6 @@ jobs:
       - name: Smoke and full unit test suite
         run: bun run check
 
-      - name: Typecheck
-        run: bun run typecheck
-
       - name: Install Python test dependencies
         run: python -m pip install -r python/requirements.txt
 
@@ -62,6 +59,29 @@ jobs:
       - name: Provider recommendation tests
         run: npm run test:provider-recommendation
 
+  typecheck:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: .bun-version
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Typecheck
+        run: bun run typecheck
+
+      - name: Type tests
+        run: bun run typecheck:type-tests
+
   web:
     runs-on: ubuntu-latest
 

CONTRIBUTING.md

@@ -165,6 +165,13 @@ Python tests:
 python -m pytest -q python/tests
 ```
 
+Typecheck (enforced by the dedicated `typecheck` CI job):
+
+```bash
+bun run typecheck
+bun run typecheck:type-tests
+```
+
 PR intent scan:
 
 ```bash
@@ -184,12 +191,6 @@ PRs that fail CI checks will not be merged.
 
 These are not enforced by CI but are worth running locally before submitting.
 
-Typecheck:
-
-```bash
-bun run typecheck
-```
-
 Focused tests:
 
 ```bash

package.json

@@ -61,7 +61,7 @@
     "typecheck": "tsc --noEmit",
     "typecheck:type-tests": "bun run scripts/typecheck-type-tests.ts",
     "smoke": "bun run build && node dist/cli.mjs --version",
-    "check": "bun run smoke && bun run typecheck:type-tests && bun run test:full",
+    "check": "bun run smoke && bun run test:full",
     "verify:privacy": "bun run scripts/verify-no-phone-home.ts",
     "build:verified": "bun run build && bun run verify:privacy",
     "test:provider": "bun test --max-concurrency=1 src/services/api/*.test.ts src/utils/context.test.ts",