chore(ci): add dedicated TypeScript typecheck workflow and root typecheck script #1437

Problem

The PR-time Lint and Test workflows in .github/workflows/ run yarn lint and yarn test respectively, but neither invokes tsc on the web package. The only place tsc runs for the web package is as a side-effect of next build inside the pr-gate.yml Docker-image build job, which is slow, shared with image building, and not the focused signal that developers watch during iterative review.

The other workspaces (backend, db, schemas, shared) all have tsc in their build scripts, so they are type-checked when those packages are built. web is the only workspace without a dedicated typecheck path.

Impact

• A PR that introduces a TypeScript compile error in packages/web is only flagged once the slow Docker build runs in pr-gate.yml. A dedicated tsc step on a focused workflow would surface the same error in seconds.
• Local developers have no yarn typecheck shortcut to type-check all workspaces; they must either run tsc per package or trigger a full next build.

Proposed solution

This PR is the first step of a two-step plan:

1. This PR (scope-cut): Add a typecheck script in the root package.json that runs tsc --noEmit in each workspace that ships TypeScript (web, backend, db, schemas, shared), using the same topological ordering as the existing test/lint scripts. Plus a per-package typecheck script (mirroring the existing test/lint patterns). Local developers can now run yarn typecheck from the repository root.
2. Follow-up PR (separate scope): Add a new CI workflow (.github/workflows/typecheck.yml) that runs yarn typecheck on PRs. This depends on first fixing latent type errors that yarn typecheck surfaces on current main (see Future work below).

Scope of this PR

• 1 root package.json change (additive).
• 5 per-package package.json changes (additive, one typecheck script each).
• No source code changes. No new dependencies. No new CI workflow.

Acceptance criteria

• yarn workspace @sourcebot/web typecheck exits 0 (with the caveats below).
• yarn workspace @sourcebot/backend typecheck exits 0.
• yarn workspace @sourcebot/db typecheck exits 0.
• yarn workspace @sourcebot/schemas typecheck exits 0.
• yarn workspace @sourcebot/shared typecheck exits 0.
• yarn typecheck from the repository root invokes each workspace's typecheck in topological order.

Future work (out of scope here)

The current main has latent type errors that surface when tsc --noEmit runs against each workspace in isolation:

• packages/web test fixtures reference fields that exist in DB migrations but were not added to the schema.prisma model (e.g., UserToOrg.lastActiveAt from migration 20260702000001, UserToOrg.suspendedAt/scimExternalId from 20260702000000). Fixing this requires either (a) updating schema.prisma to declare those columns, or (b) re-running prisma generate, depending on intent. Either way, that is its own scope.
• packages/db had a stale Prisma client before this work; running yarn prisma:generate locally resolves the immediate AgentSkill* errors. This is documented as a prerequisite for the follow-up CI workflow PR.

A follow-up PR will: (1) fix the schema-drift in schema.prisma, (2) update test fixtures to match, (3) add the .github/workflows/typecheck.yml CI workflow introduced in this issue's proposed solution. Tracking in this issue so the work isn't lost.

Backward compatibility

None. Pure additive tooling. Existing build/test/lint scripts unchanged.