ci: gitea actions — lint, typecheck, broker tests, amd64 build verify

Four parallel jobs on push to main and on PRs:

- lint — pnpm lint (turbo across workspace)
- typecheck — pnpm typecheck (turbo across workspace)
- test-broker — pgvector/pg17 service container, drizzle-kit migrate,
  then vitest on apps/broker (64 tests per DEPLOY_SPEC.md)
- build-amd64 — docker buildx build of broker + migrate + web images
  for linux/amd64 (catches Linux-only Dockerfile bugs that Mac local
  buildx can't hit reliably, closes the documented multi-arch followup)

All jobs use frozen-lockfile install + pnpm-store cache via setup-node.
Regenerates pnpm-lock.yaml to resolve apps/cli zod catalog drift that
was silently blocking any frozen-lockfile install (shipped under same
commit since CI cannot pass without it).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pnpm-lock.yaml

@@ -173,7 +173,7 @@ importers:
         specifier: 8.20.0
         version: 8.20.0
       zod:
-        specifier: 'catalog:'
+        specifier: 4.1.13
         version: 4.1.13
     devDependencies:
       '@turbostarter/eslint-config':