Wire CI workflow to actually run typecheck + tests

[Declade]

Problem

.github/workflows/ci.yml is a placeholder echo step. npm ci, npm run typecheck, and npm test are not actually run on PRs or main pushes.

This degrades the value of the test infrastructure we are building. Concretely, PR #6 (Session 2b-apiKey) added a @ts-expect-error directive inside ts/src/client.test.ts that pins the apiKey privatization at the TS-type level — a regression that re-introduces a public apiKey property is only caught by npm run typecheck. Until CI runs typecheck, that tripwire only fires locally on the developer's machine.

The same gap will undercut every future TS-level guard we add.

Proposed fix

Wire the ts/ job in .github/workflows/ci.yml to:

- name: Install
  working-directory: ts
  run: npm ci

- name: Typecheck
  working-directory: ts
  run: npm run typecheck

- name: Test
  working-directory: ts
  run: npm test

Trigger on pull_request and push: branches: [main]. Pin Node to the engines floor (>=18.17) via setup-node with node-version-file or an explicit node-version.

Out of scope here: build/publish jobs (separate concern; publish-ts.yml already a stub for that).

Acceptance

• A PR that adds a TS error in ts/src/**/*.ts fails CI.
• A PR that breaks an existing test in ts/src/**/*.test.ts fails CI.
• A PR that removes the @ts-expect-error directive in the apiKey-hiding test fails CI (tsc reports TS2578 unused-expect-error).

Priority

HIGH. Prerequisite for catching future regressions of the kind PR #6 is guarding against.

Surfaced by

Subagent review on PR #6 (commit d8372bc), bug-hunter-reviewer M1 finding.