Make the PR workflow a real gate

- every matrix step (lint, test, build) must pass; nothing is allowed
  to fail silently
- after build, scripts/check-built-manifests.py checks the package.json
  each build/ directory holds, which is what npm receives: entry points
  must exist, no ./build/ or ./cjs/cjs/ paths, no string spread into
  exports, no workspace:/link: ranges
- the tree must be unchanged after the step: `yarn lint` runs
  eslint --fix and `yarn build` regenerates the augment interfaces, so
  both used to pass on a tree they had rewritten
- the dot-notation exclusion had been renamed from kusama to zagros
  (no such directory) instead of dicle; with the dicle augmentation in
  the lint program, eslint --fix rewrote api.query['registrar'] style
  accesses that the build cannot compile
- the four compiled-only packages (bizinikiwi-bindings,
  merkleize-metadata, metadata-builders, papi-utils) have no sources
  here and are not linted
- the auto-approve and auto-merge bots are removed
- .prettierrc.cjs uses @pezkuwi/dev

.github/workflows/auto-approve.yml

@@ -1,16 +0,0 @@
-name: bot
-
-on:
-  pull_request:
-    types: [labeled]
-
-jobs:
-  approve:
-    if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jacogr/action-approve@795afd1dd096a2071d7ec98740661af4e853b7da
-        with:
-          authors: jacogr, TarikGul
-          labels: -auto
-          token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/auto-merge.yml

@@ -1,16 +0,0 @@
-name: bot
-
-on:
-  pull_request:
-    types: [labeled]
-
-jobs:
-  merge:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jacogr/action-merge@d2d64b4545acd93b0a9575177d3d215ae3f92029
-        with:
-          checks: pr (build),pr (lint),pr (test)
-          labels: -auto
-          strategy: squash
-          token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/pr-any.yml

@@ -3,10 +3,10 @@ on: [pull_request]
 
 jobs:
   pr:
-    continue-on-error: true
     strategy:
+      fail-fast: false
       matrix:
-        step: ['lint', 'test', 'build', 'deno']
+        step: ['lint', 'test', 'build']
     runs-on: ubuntu-latest
     env:
       YARN_ENABLE_SCRIPTS: false
@@ -15,11 +15,19 @@ jobs:
     - uses: actions/setup-node@v4
       with:
         node-version: 'lts/*'
-    - uses: denoland/setup-deno@v1
-      with:
-        deno-version: v1.46.3
     - name: ${{ matrix.step }}
       if: always()
       run: |
         yarn install --immutable
         yarn ${{ matrix.step }}
+    # `yarn lint` runs eslint --fix and `yarn build` regenerates the augment
+    # interfaces, so both pass on a tree they rewrote. The committed tree must
+    # already be what they produce.
+    - name: tree unchanged
+      run: git diff --exit-code --stat
+    # The package.json each build/ directory holds is what npm receives: every
+    # entry point must name a file that is there, with no ./build/ or ./cjs/cjs/
+    # path and no string spread into exports (the January 2026 fault).
+    - name: check built manifests
+      if: matrix.step == 'build'
+      run: python3 scripts/check-built-manifests.py .