CI: let the PR checks fail, check the built manifests, drop the auto bots

- continue-on-error came with the upstream template: lint, build and test
  have been red here while every pull request read as passing (12 test
  failures and 603 lint errors before this branch). fail-fast: false keeps
  each step running when another fails.
- after build, scripts/check-built-manifests.py checks the package.json in
  every build/ directory, the file npm receives (the January 2026 ./cjs/cjs
  fault, and the wasm 7.5.19 one).
- auto-approve/auto-merge (upstream author's actions, merge on a '-auto'
  label once checks reported) are removed, as in pezkuwi-apps.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/workflows/pr-any.yml

@@ -3,8 +3,8 @@ on: [pull_request]
 
 jobs:
   pr:
-    continue-on-error: true
     strategy:
+      fail-fast: false
       matrix:
         step: ['lint', 'test', 'build', 'deno']
     runs-on: ubuntu-latest
@@ -26,3 +26,9 @@ jobs:
         deno --version
         yarn install --immutable
         yarn ${{ matrix.step }}
+    # The package.json each build/ directory holds is what npm receives: every
+    # entry point must name a file that is there, with no ./build/ or ./cjs/cjs/
+    # path and no string spread into exports (the January 2026 fault).
+    - name: check built manifests
+      if: matrix.step == 'build'
+      run: python3 scripts/check-built-manifests.py .