Fix CI: order steps by artifact dependency, resolve fresh-clone builds

CI failed at Lint with 1519 no-unsafe-* errors on every cross-package
import. Three fresh-checkout issues, invisible locally because lib/
persists between runs:

- Lint ran before Typecheck, but the type-aware ESLint config resolves
  vendor packages via their built declarations (tsconfig.typecheck.json
  -> vendor/*/lib), which Typecheck emits. Reordered.
- The first-ever tsc -b resolved sibling vendor plugins through their
  package.json types (lib/index.d.ts, not yet emitted) — TS2307 until a
  second run. The source-level paths map moves from the root
  tsconfig.json (dev-only, not inherited by package builds) into
  tsconfig.base.json so the whole build graph resolves source-first;
  tsconfig.typecheck.json still overrides wholesale to lib resolution.
- Hygiene ran publint (validates packed lib/index.js bundles) before
  Build emitted them. Reordered.

Also: checkout/setup-node bumped v4 -> v6 (node20 runners are
force-switched to node24 on 2026-06-16), the Build step name catches up
with tsdown, and AGENTS.md documents the one case where a fresh clone
needs `yarn typecheck` before `yarn lint`.

.github/workflows/ci.yml

@@ -18,9 +18,9 @@ jobs:
         node: [24, 26]
     name: node ${{ matrix.node }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
 
@@ -33,21 +33,27 @@ jobs:
       - name: Constraints
         run: yarn constraints
 
-      - name: Lint
-        run: yarn lint
-
+      # Before lint: the type-aware ESLint config resolves vendor packages via
+      # their built declarations (tsconfig.typecheck.json -> vendor/*/lib),
+      # which `yarn typecheck` emits. Lint on a fresh checkout would otherwise
+      # see unresolved types and erupt with no-unsafe-* errors.
       - name: Typecheck (src + tests + examples)
         run: yarn typecheck
 
+      - name: Lint
+        run: yarn lint
+
       - name: Tests with coverage gate (per-file 100%)
         run: yarn test:coverage
 
+      # Before hygiene: publint validates the packed artifacts (lib/index.js),
+      # which only the tsdown bundling step emits.
+      - name: Build (tsc -b + tsdown bundles)
+        run: yarn build
+
       - name: Hygiene (knip + publint)
         run: yarn knip && yarn publint
 
-      - name: Build (tsc -b + dumble bundles)
-        run: yarn build
-
       - name: Demo smoke test
         run: |
           set -euo pipefail