Make the PR workflow a real gate

- continue-on-error is removed; lint, test and build each have to pass,
  and fail-fast is off so each reports on its own
- after each step the tree must be unchanged (eslint --fix,
  packageInfo.ts written by the build)
- after build, scripts/check-built-manifests.py checks the package.json
  npm receives from each build/ directory
- push-main installs with --immutable and checks the manifests too
- the auto-approve and auto-merge bots are removed

.github/workflows/push-main.yml

@@ -5,19 +5,21 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build:
-    if: "! startsWith(github.event.head_commit.message, '[CI Skip]')"
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
     - uses: actions/setup-node@v4
       with:
         node-version: 'lts/*'
     - name: Build
       run: |
         corepack enable
-        yarn install
+        yarn install --immutable
         yarn build
+    - name: Check built manifests
+      run: python3 scripts/check-built-manifests.py .