chore: improve code-quality tooling, OpenCode diagnostics, and lint performance (#3774)

.github/workflows/lint.yml

@@ -0,0 +1,74 @@
+name: Lint
+
+# Authoritative lint, type-check, and format checks. These back required
+# status checks, so there is no paths filter on pull_request: a filtered-out
+# run never reports, leaving the check at "Expected" forever.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - develop
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lint-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint (JS/YAML/package.json)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts --prefer-offline --no-audit --no-fund
+
+      - name: Lint JS, YAML and package.json
+        run: npm run lint
+
+  typecheck:
+    name: Typecheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts --prefer-offline --no-audit --no-fund
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      # Astro component checking: `tsc` cannot read .astro files, so a type error in a
+      # page's markup or inline script passes the step above. The website has 36
+      # existing findings, so this reports them without failing the job; make it
+      # blocking by deleting `continue-on-error` once they are cleared.
+      - name: Install website dependencies
+        run: npm ci --prefix website --ignore-scripts --prefer-offline --no-audit --no-fund
+
+      - name: Astro check (informational)
+        continue-on-error: true
+        run: npm run typecheck:astro

.github/workflows/workflow-lint.yml

@@ -75,6 +75,7 @@ jobs:
             .github/workflows/changelog-unified.yml \
             .github/workflows/documentation.yml \
             .github/workflows/labeling-unified.yml \
+            .github/workflows/lint.yml \
             .github/workflows/orchestrate-phase-progression.yml \
             .github/workflows/phase-progression.yml \
             .github/workflows/pr-template-routing.yml \