CI does not run typecheck or lint, and does not install the pdf-service

[AlaskanTuna]

.github/workflows/ci-cd.yml runs pnpm build and pnpm test — but not pnpm typecheck and not pnpm lint. Separately, services/pdf-service sits outside the pnpm workspace by design, yet root typecheck reaches into it with pnpm --dir services/pdf-service exec tsc. On a fresh CI checkout, pnpm install --frozen-lockfile at the root does not install that directory's dependencies, so even if typecheck were added to CI it would be typechecking against absent node_modules. The "outside the workspace but validated by root scripts" arrangement is therefore not currently coherent, and CI is not enforcing the two gates most likely to catch a regression. Sequenced after task 10 because that task rewrites the deploy job in the same file.

Scope: .github/workflows/ci-cd.yml, package.json, services/pdf-service/package.json

Depends on: #9, #14

Checklist

• Add pnpm typecheck and pnpm lint steps to the ci job, before pnpm test
• Add an explicit install step for services/pdf-service (npm ci --prefix services/pdf-service) so the root typecheck has something to typecheck against
• Confirm the pdf-service has its own committed lockfile; if it does not, that is the actual root cause and must be fixed first
• Decide and record whether the pdf-service stays outside the workspace. The comment in pnpm-workspace.yaml gives a real reason (isolated Vercel deploy), so the likely right answer is "keep it out, but make the validation honest" rather than folding it in
• Document the arrangement in AGENTS.md's repo-layout section so the next reader does not rediscover it
• verify: CI is green on a clean main with all four gates (build, typecheck, lint, test) running
• verify: a deliberate type error inside services/pdf-service fails CI — this is the whole point of the task and must be tested, not assumed
• verify: the deploy job still runs only on push to main and is unaffected

---

_{Priority: Medium · Phase 12 task 16 of the maintainer's migration plan.}

Correction (29/07/26): an earlier revision of this issue specified pnpm --dir services/pdf-service install --frozen-lockfile. That cannot work — services/pdf-service is outside the pnpm workspace by design and its committed lockfile is package-lock.json, so there is no pnpm-lock.yaml for --frozen-lockfile to read. Use npm ci there. This holds regardless of the Bun migration.