fix(ci): add build step before tests, audit production deps only

E2E and integration tests shell out to dist/cli/index.js, which
requires a build step. Security audit now scopes to production
dependencies to avoid false positives from dev tooling.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sjsyrek

.github/workflows/ci.yml

@@ -26,4 +26,5 @@ jobs:
       - run: npm ci
       - run: npm run lint
       - run: npm run type-check
+      - run: npm run build
       - run: npm test

.github/workflows/security.yml

@@ -23,5 +23,5 @@ jobs:
 
       - run: npm ci
 
-      - name: Run npm audit
-        run: npm audit --audit-level=moderate
+      - name: Run npm audit (production only)
+        run: npm audit --audit-level=moderate --omit=dev