ci: split typecheck into its own PR-checks job (#1599)

The Typecheck step lived inside the smoke-and-tests job and
typecheck:type-tests ran inside `bun run check`, so type errors were
buried mid-job and serialized behind the build. They now run as a
dedicated parallel `typecheck` job (tsc --noEmit + the focused type
tests) with its own status check, and `check` slims to
smoke + test:full so nothing runs twice in CI. Local scripts
(typecheck, typecheck:type-tests, hardening:strict) are unchanged.

Review feedback: the new job's checkout sets
persist-credentials: false (no credentials needed), and
CONTRIBUTING.md now documents typecheck as a CI-enforced check
instead of a recommended-local-only one.

Validation: workflow YAML parses (jobs: smoke-and-tests, typecheck,
web); typecheck exit 0; type-tests green; `bun run check` green.

Co-authored-by: OpenClaude <openclaude@gitlawb.com>

CONTRIBUTING.md

@@ -165,6 +165,13 @@ Python tests:
 python -m pytest -q python/tests
 ```
 
+Typecheck (enforced by the dedicated `typecheck` CI job):
+
+```bash
+bun run typecheck
+bun run typecheck:type-tests
+```
+
 PR intent scan:
 
 ```bash
@@ -184,12 +191,6 @@ PRs that fail CI checks will not be merged.
 
 These are not enforced by CI but are worth running locally before submitting.
 
-Typecheck:
-
-```bash
-bun run typecheck
-```
-
 Focused tests:
 
 ```bash