Make CI run the real checks and a dependency audit #193

Priority: P1

Context

CI runs yarn test rather than each package's check script, so --forbid-only is never enforced and a stray it.only passes CI. There's also no vulnerability scanning anywhere in the pipeline.

Do (in .github/workflows/ci.yml)

• Replace the yarn compile, yarn lint and yarn test steps with yarn check. At the root that runs turbo check && yarn lint; per package it runs compile plus test with --forbid-only. CI then runs exactly what a developer runs locally.
  • examples/jest isn't covered because Jest has no forbid-only flag. That's acceptable, it's only an example.
• Add an audit job on a single Node version that runs yarn npm audit --all --recursive --severity high with continue-on-error: true. Note in the PR that it becomes blocking once Batched transitive-dependency upgrade to clear high-severity alerts #188 lands.
• Don't touch release.yml or pages.yml.

Done when

A throwaway commit with it.only fails CI on the PR. Revert it before review.

Source: code audit of stackbuilders/assertive-ts at e81a614 (2026-10-13) plus open Vanta/Dependabot findings.