Gate root, web, and VS Code builds and typechecks in CI

[Railly]

Context

Current CI validates only the root build, lint, and Bun tests. Root TypeScript has no compiler gate, and the independently packaged web and VS Code surfaces are not checked.

Evidence:

• .github/workflows/ci.yml:16-25 runs only root commands.
• package.json has no typecheck script.
• web/package.json defines independent build and Biome lint commands.
• vscode/package.json defines build, typecheck, and package commands.
• The current VS Code typecheck includes root bun:test files and fails.
• The current web lint command also has existing failures.

Task

Establish green baselines, then add required CI jobs for every shipped surface using each package's Bun lockfile.

Acceptance criteria

• Root runs tests, lint, build, and explicit TypeScript checking.
• Web runs frozen install, lint, and production build.
• VS Code runs frozen install, typecheck, build, and VSIX packaging.
• Test files are included only in compatible TypeScript programs.
• Each surface reports an independent required check.