Make the PR workflow a real gate

- continue-on-error is removed; lint, test, build:code and build:i18n
  each have to pass, with fail-fast off so each reports on its own
- after each step the tree must be unchanged: eslint --fix, the i18n
  catalogue and typesBundle.ts are all rewritten by these steps
- the chmod step is dropped; the scripts are run through node

.github/workflows/pr-any.yml

@@ -3,8 +3,9 @@ on: [pull_request]
 
 jobs:
   pr:
-    continue-on-error: true
     strategy:
+      # Each step reports on its own; one red step must not cancel the others.
+      fail-fast: false
       matrix:
         step: ['lint', 'test', 'build:code', 'build:i18n']
     runs-on: ubuntu-latest
@@ -13,9 +14,13 @@ jobs:
     - uses: actions/setup-node@v4
       with:
         node-version: 'lts/*'
-    - name: Set Execute Permissions
-      run: chmod +x ./scripts/*
     - name: ${{ matrix.step }}
       run: |
+        corepack enable
         yarn install --immutable
         yarn ${{ matrix.step }}
+    # `yarn lint` runs eslint --fix, build:i18n rewrites the translation
+    # catalogue and build:code regenerates typesBundle.ts, so each passes on a
+    # tree it changed. The committed tree must already be what they produce.
+    - name: tree unchanged
+      run: git diff --exit-code --stat