Add type checking, package linting, and security audit to CI

- tsc --noEmit: catches type errors tsdown doesn't surface
- publint + attw: validates package exports resolve correctly for all consumers
- npm audit: fails CI on known vulnerabilities

All four checks are workspace-aware for future packages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Goosterhof

.github/workflows/ci.yml

@@ -15,8 +15,11 @@ jobs:
         with:
           node-version: 24
       - run: npm ci
+      - run: npm audit
       - run: npm run format:check
       - run: npm run lint
+      - run: npm run typecheck
       - run: npm run build
+      - run: npm run lint:pkg
       - run: npm run test:coverage
       - run: npm run test:mutation