ci: split quality checks into separate jobs

[alepouna]

What changed

• split the existing CI workflow into separate lint, markdown, typecheck, and build jobs
• kept the workflow running on both pull requests and pushes to master
• added workflow_dispatch and concurrency cancellation for cleaner reruns
• added a dedicated typecheck script so CI can report type-check status separately from the build

Why

• make GitHub checks easier to read and easier to require individually in branch protection
• let failures point directly at the specific category that broke instead of hiding inside one serial job
• keep PR validation and post-merge validation aligned