ci: harden CI — frontend job (biome+tsc+build) and expand rust matrix

[igorvieira]

Summary

• Adds frontend job: biome ci, tsc --project tsconfig.build.json --noEmit, bun run build. Closes audit gaps C2, C3 (no typecheck/lint in CI).
• Expands test-rust matrix from [macos-latest] to [macos-latest, ubuntu-22.04, windows-latest] with fail-fast: false. Closes audit gap C4 (no Linux/Windows verification before release).
• Conservative scope: deliberately does NOT add bun run test (24 pre-existing styling-test failures need fixing first) or cargo clippy -D warnings (6 existing violations).

Follow-ups

• Fix the 24 styling-related frontend test failures, then add bun run test to CI
• Fix clippy violations (large_enum_variant in import types, etc.), then add cargo clippy -D warnings
• Decide Bun vs npm and remove the unused lockfile (audit C7)
• Repair manual-release.yml calling nonexistent release.yml (audit C6)
• Add Dependabot config (audit C11)

Test plan

• Local bunx biome ci . passes
• Local bunx tsc --project tsconfig.build.json --noEmit passes
• Local bun run build produces dist/
• CI — frontend job green
• CI — test-rust passes on macos-latest (current behavior)
• CI — test-rust passes on ubuntu-22.04 (new — may surface platform-specific issues)
• CI — test-rust passes on windows-latest (new — may surface platform-specific issues)