CI: let the PR checks fail, check the built manifests, drop the auto bots

- continue-on-error came with the upstream template: lint, build and test
  have been red here while every pull request read as passing (12 test
  failures and 603 lint errors before this branch). fail-fast: false keeps
  each step running when another fails.
- after build, scripts/check-built-manifests.py checks the package.json in
  every build/ directory, the file npm receives (the January 2026 ./cjs/cjs
  fault, and the wasm 7.5.19 one).
- auto-approve/auto-merge (upstream author's actions, merge on a '-auto'
  label once checks reported) are removed, as in pezkuwi-apps.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/workflows/auto-approve.yml

@@ -1,16 +0,0 @@
-name: bot
-
-on:
-  pull_request:
-    types: [labeled]
-
-jobs:
-  approve:
-    if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jacogr/action-approve@795afd1dd096a2071d7ec98740661af4e853b7da
-        with:
-          authors: jacogr, TarikGul
-          labels: -auto
-          token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/auto-merge.yml

@@ -1,16 +0,0 @@
-name: bot
-
-on:
-  pull_request:
-    types: [labeled]
-
-jobs:
-  merge:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jacogr/action-merge@d2d64b4545acd93b0a9575177d3d215ae3f92029
-        with:
-          checks: pr (build),pr (lint),pr (test)
-          labels: -auto
-          strategy: squash
-          token: ${{ secrets.GH_PAT_BOT }}

.github/workflows/pr-any.yml

@@ -3,8 +3,8 @@ on: [pull_request]
 
 jobs:
   pr:
-    continue-on-error: true
     strategy:
+      fail-fast: false
       matrix:
         step: ['lint', 'test', 'build', 'deno']
     runs-on: ubuntu-latest
@@ -26,3 +26,9 @@ jobs:
         deno --version
         yarn install --immutable
         yarn ${{ matrix.step }}
+    # The package.json each build/ directory holds is what npm receives: every
+    # entry point must name a file that is there, with no ./build/ or ./cjs/cjs/
+    # path and no string spread into exports (the January 2026 fault).
+    - name: check built manifests
+      if: matrix.step == 'build'
+      run: python3 scripts/check-built-manifests.py .