ci: allow the SubQuery indexer packages in Dependency Review

The indexer image now installs from a lockfile, so Dependency Review sees
the @subql packages it builds the indexer from. The mapping imports only
their types, which are erased on emit; the build job now checks that no
@subql import survives in the emitted mapping.

.github/workflows/ci.yml

@@ -31,6 +31,16 @@ jobs:
       - name: Build
         run: ./node_modules/.bin/subql build pezkuwi.yaml
 
+      # Dependency Review allows the @subql packages because the mapping imports
+      # only their types; this is the check that keeps it true. A type-only
+      # import is erased on emit, a value import survives as a require.
+      - name: The mapping imports no @subql code
+        run: |
+          out=$(mktemp -d)
+          ./node_modules/.bin/tsc -p tsconfig.json --outDir "$out" --declaration false
+          ! grep -rn 'require("@subql/' "$out" || {
+            echo "the mapping imports @subql code; import its types with 'import type' or drop it"; exit 1; }
+
   # The noter and payout bots ship as their own images (docker-compose.prod.yml)
   # and nothing else here builds or runs them. Build each image as production
   # does, then run inside it: the crypto stack must be the locked one and sign