ci: add pull request quality gate

[andrei-hasna]

Summary

• run frozen Bun install, build, typecheck, and the full test suite on every pull request and push to main
• add the missing typecheck package script
• restore HASNA_TERMINAL_DIR in the output-store test so the existing suite is hermetic
• document the CI gate in the changelog

Testing

• bun install --frozen-lockfile
• bun run build
• bun run typecheck
• bun test (237 passed across 38 files)

The first clean full-suite run exposed the output-store test leaking HASNA_TERMINAL_DIR into paths.test.ts; the test-only cleanup above fixes that isolation issue. No suites are excluded or skipped.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}