chore(ci): gate deploys on new advisories, restore lint and typecheck

Second review follow-up.

Audit gate: a flat `npm audit --audit-level=<x>` cannot work here at any
level - the tree reports 102 advisories (12 low, 38 moderate, 52 high) and
`--omit=dev` does not change the counts, because gatsby itself is a runtime
dependency of the build. Gating on the tree as a whole stops publishing
permanently; ignoring it lets a new advisory through. scripts/audit-gate.mjs
fails on any critical/high advisory that is not in scripts/audit-baseline.json,
which carries an owner and a reason, so today's set is a tracked exception and
anything new blocks the deploy. Verified both ways: exit 0 on the committed
baseline, exit 1 with an entry removed.

Lint and typecheck: the deleted GitHub workflow was the only place they ran, so
`npm run typecheck` and `npm run lint` are now steps in the publish workflow,
ahead of the build. Lint could not simply be switched on - prettier reported 8
pre-existing files on main, all single-line indentation - so those are fixed
here and the check is clean rather than baselined.

Verified locally in the order the workflow runs: audit gate 0, typecheck clean,
lint clean (8 files reformatted, indentation only), build 136 pages.

.gitea/workflows/publish.yml

@@ -26,14 +26,23 @@ jobs:
       - name: Install dependencies
         run: npm ci --legacy-peer-deps
 
-      # Blocking gate, at CRITICAL only. `npm audit` fails on the severity you
-      # name, so `--audit-level=low` (or the default) would stop every deploy
-      # today: the Gatsby 5 tree carries ~100 advisories at low/moderate/high
-      # that have no non-breaking fix, and publishing would simply never run.
-      # Critical is the line worth stopping a deploy for, and the tree is clear
-      # of it - keep it that way rather than gating on noise nobody will action.
-      - name: Audit for critical vulnerabilities
-        run: npm audit --audit-level=critical
+      # Blocking gate. `npm audit --audit-level=<x>` is all-or-nothing and this
+      # tree cannot pass a flat gate at any level: the Gatsby 5 build toolchain
+      # carries ~100 advisories with no non-breaking fix, so gating on the tree
+      # as a whole stops publishing permanently. scripts/audit-gate.mjs instead
+      # accepts the known set (scripts/audit-baseline.json, with an owner and a
+      # reason) and FAILS on any new critical/high advisory.
+      - name: Audit for new critical/high advisories
+        run: node scripts/audit-gate.mjs
+
+      # The prettier and type checks used to live in a GitHub workflow that
+      # never ran on this forge; keep them ahead of the build so a type or
+      # formatting error blocks the deploy rather than shipping.
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Check prettier offences
+        run: npm run lint
 
       - name: Build
         run: npm run build