Make the PR checks able to fail, and fix what they had been hiding

pr-any.yml ran lint, test and build with continue-on-error: true, so every
PR showed success while main had 41 lint errors and 19 of 61 tests failing.
The flag is removed and the failures are fixed:

- TypeScript 5.5.4 -> 5.9. @pezkuwi/util and friends ship declarations
  with Uint8Array<ArrayBufferLike>, which 5.5 cannot read, so every such
  value was typed `any` here (the 16 wrapBytes errors). The pin dates from
  a styled-components declaration problem that went away with the move
  back to styled-components 5; build and lint pass on 5.9.
- State.ts: the stored security log is parsed through a function that
  returns an empty log for anything that is not a JSON array, instead of
  letting `any` flow on; fire-and-forget logging uses .catch(console.error)
  like the rest of the codebase; object keys sorted.
- buildHierarchy.spec.ts: a rename had replaced the genesis hashes with
  0x..01 / 0x..02, which resolve to no network name, so sorting by network
  had nothing to sort on. The test now takes two real entries from
  chains.ts by name.
- scripts/*.cjs is in the lint project (it failed to parse); header and
  key order fixed in postbuild-cleanup.cjs.
- temp_ff_validate/ (43 build files) and pezkuwi-chrome-0.62.22.zip were
  committed by accident in f5495f7; removed and ignored.

16 of the 19 failing tests are not fixed here: they fail because
@pezkuwi/wasm-crypto 7.5.18 stubs ed25519, secp256k1 and sr25519
derivation. With the 7.5.19 build from pezkuwi-wasm#2 installed locally,
lint is clean and all 61 tests pass. Until 7.5.19 is published and
picked up here, those 16 stay red on this PR, which is the point.

.github/workflows/pr-any.yml

@@ -3,7 +3,6 @@ on: [pull_request]
 
 jobs:
   pr:
-    continue-on-error: true
     strategy:
       matrix:
         step: ['lint', 'test', 'build', diff]