ci: split checks into lint and test jobs, harden the workflow

[galatanovidiu]

Restructures ci.yml. The workflow added in #101 already ran on pull requests, but it was a single job using floating action tags and no permission floor.

Split into two jobs

lint and test replace the single verify. A formatting failure and a test failure are now distinguishable at a glance instead of both showing as one red check, they run in parallel, and each can be required independently.

Hardening

• permissions: {} at workflow level, with contents: read granted per job. Deny by default, grant explicitly.
• Actions pinned to full commit SHAs, version in a trailing comment. A tag like @v4 can be repointed at new code by whoever controls it; a digest cannot.
• persist-credentials: false on checkout, so the job token is not written into .git/config where any later step could read it.
• ubuntu-24.04 instead of ubuntu-latest — the runner image stops changing underneath us.
• Per-job timeout-minutes, so a hung job fails instead of burning the full 6-hour default.
• Explicit pull_request types (opened, synchronize) and workflow_dispatch for manual runs.

One step that is load-bearing, not stylistic

The test job builds before running jest.

tests/integration/bundle-version-interpolation.test.ts asserts against dist/proxy.js and wraps itself in describeIfBuilt — when the bundle is absent it skips silently. A test job without a build step would report green while quietly dropping that test. That is the same failure mode as the npx jest tests/unit/ command that was labelled "run all tests" while omitting the integration suites.

Required check names change

From verify to Lint and typecheck and Unit and integration tests.

The protect trunk ruleset currently has no required_status_checks rule, so nothing breaks on merge — but both names need adding afterwards for the gate to bite.

Not included

• No .nvmrc exists, so node-version: "22" is explicit, matching what release.yml publishes with. Adding one would be a reasonable follow-up.
• No test matrix — this is a single-runtime Node package.