👷 Run publint in the CI build job

publish:publint and publish:attw only ran in the tag-triggered publish
job, so a packaging break stayed green until release. Add publint to
build (offline, fast, packs the built dist). attw stays in publish,
where the full resolution matrix is worth the cost.

backlog.tasks

@@ -28,9 +28,9 @@ Setup:
     - AGENTS.md only warns that empty LSP output is inconclusive, not that it can emit false errors
     ☐ Add a line to AGENTS.md: ignore LSP errors that `check:tsc` does not reproduce
     ☐ Or fix the LSP server configuration so it picks up `tsconfig.json`
-☐ Run packaging checks in CI `build`
+✔ Run packaging checks in CI `build` @done
     - `publish:publint` / `publish:attw` only run in the tag-triggered `publish` job, so a PR that breaks packaging stays green until release
-    ☐ At minimum add `publish:publint` to the `build` job (offline, fast); `attw` needs a pack
+    ✔ At minimum add `publish:publint` to the `build` job (offline, fast); `attw` needs a pack @done
 ☐ Publish the exact artifact CI tested
     - `publish: needs: build`, then re-runs `npm ci` + `build` from scratch, discarding the tested output
     - tag push pays a double build and the two builds could differ