chore(ci): add typecheck workflow to wire PR #1438 tooling into CI #1460

Problem

PR #1438 added a root yarn typecheck script and per-package typecheck scripts that run tsc --noEmit in every TypeScript workspace (web, backend, db, schemas, shared). The local tooling half of the original plan is shipped; the CI workflow half was deliberately deferred to this follow-up.

Without a CI workflow, the new tooling is opt-in for contributors only. We need a PR-time check so that breaking tsc is surfaced on the PR timeline within seconds (parallel to the existing lint.yml and test.yml workflows).

Proposed solution

Add .github/workflows/typecheck.yml that runs on every PR targeting main:

name: Typecheck
on:
  pull_request:
    branches: ["main"]
jobs:
  typecheck:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
        with: { submodules: "true" }
      - uses: actions/setup-node@v4
        with: { node-version: '20.x', cache: 'yarn', cache-dependency-path: '**/yarn.lock' }
      - run: yarn install --frozen-lockfile
      - run: yarn db:generate  # ensures the Prisma client is fresh before db typecheck
      - run: yarn typecheck

Why the web workspace is excluded from this workflow

packages/web's tsc --noEmit depends on .next/types/**/*.ts (declared in its tsconfig.json include) being generated by next build. Without that, tsc reports a flood of "Cannot find module '@/public/...'" errors. The web package is already type-checked transitively via next build inside the existing pr-gate.yml Docker build job. CI time on web is dominated by the Docker build itself, so a separate tsc --noEmit step adds latency without catching anything new.

Approach: have the workflow matrix exclude @sourcebot/web via yarn workspaces foreach --all --topological run typecheck --exclude @sourcebot/web. The remaining 4 workspaces (backend, db, schemas, shared) have no .next-generation dependency and type-check cleanly.

Acceptance criteria

• The new Typecheck CI workflow reports a status on every PR targeting main.
• yarn typecheck from the repository root exits 0 on current main (after yarn db:generate).
• yarn workspace @sourcebot/{backend,db,schemas,shared} typecheck -> exit 0.
• The workflow fails fast on the first workspace that fails type-checking.

Backward compatibility

None. Pure additive tooling.

Out of scope

• Re-architecting the web tsconfig.json to split build-time types from source types.
• Adding tsc --watch for dev mode.
• Replacing the existing pr-gate.yml Docker build's type-check step with this workflow's step.

Refs #1437 (umbrella issue)