fix(ci): add PR build/test gate and repair all tsc -b + lint failures

[krisnye]

Description

The repo had no pull_request CI workflow and main had no branch protection, so PR #114 merged green even though tsc -b and lint were red. (Dev-time tsc --noEmit is a no-op in packages/data because tsconfig.json contains only references — the real check is tsc -b.)

This PR adds a CI gate and fixes every failing check — pre-existing and new — so the gate is green.

Type errors fixed (tsc -b)

• database.index.test.ts (new, from feat(ecs): add reactive observe(arg) to index handles #114): the ordered-select routing tests referenced where/order columns not in include (constrained to Pick<C, Include>), and a seed helper typed db as the empty Database. Both fixed.
• TransactionResult.changedComponents: Set<keyof C | string> → Set<string>. Component names are always strings; the keyof C only widened to string|number|symbol for a generic C, which broke the type-erased TransactionResult<unknown> boundary the reconciler / concurrency strategy is written against. Removed the now-unnecessary producer-side as keyof C workaround casts.
• reconciling applier: store entries as ReconcilingEntry<any,any,any> — the layer is intentionally type-erased over getTransaction's any-ctx transactions.
• create-store.test.ts: guard optional .health?.current.

Lint errors fixed

• create-database.test.ts: added a description to each @ts-expect-error.
• test-setup.ts: import { webcrypto } instead of require().

CI / tooling

• .github/workflows/ci.yml — runs typecheck + lint + tests on every PR and push to main, scoped to @adobe/data (where the regression class occurred; can be extended to other packages later).
• packages/data scripts: typecheck (builds the wasm artifact the source imports, then tsc -b — correct for the project-reference build) and test:ci (SKIP_PERF=1).
• vite.config.js / vitest.workspace.ts: exclude *.performance.test.ts when SKIP_PERF=1, so the gate is deterministic (timing-ratio perf tests are flaky on shared runners). A normal pnpm test still runs them locally.

Follow-up (separate, requires admin)

Adding the workflow makes the check run on PRs; to make a red check block merge, main needs branch protection requiring this check. main currently has none — I'll configure that after this check first reports.

Related PRs

• Fixes the build/lint breakage merged in feat(ecs): add reactive observe(arg) to index handles #114.

🤖 Generated with Claude Code

[krisnye]

CI gate red/green verification ✅

Branch protection on main now requires the @adobe/data — typecheck, lint, test check (strict, enforce_admins). Verified end-to-end on this PR:

Commit	Change	CI conclusion	Failing step	PR merge state
d74e522	deliberate type error (probe)	❌ failure	Type-check (tsc -b, project references)	BLOCKED
537c96a	probe removed	✅ success	—	CLEAN (mergeable)

So a broken build/type-check now blocks merge instead of merging green — the regression class behind #114 (where tsc -b was red but no gate existed and main had no branch protection) can no longer recur. The probe commits are transient and collapse on squash-merge; the net diff is the intended fix only.