feat: add node-type-check job for TypeScript type checking

Presentation

Add a new optional node-type-check job to the build stage that runs TypeScript type checking (e.g. vue-tsc --noEmit or tsc --noEmit).

New inputs:

• type-check-enabled (boolean, default: false) — enables the job
• type-check-args (string, default: run type-check) — the package manager script arguments

The job follows the same pattern as node-lint: disabled by default, gated by NODE_TYPE_CHECK_ENABLED, and applies .test-policy rules.

Closes: #58 (closed)

Checklist

• General:
  • use rules instead of only/except
  • optimized cache configuration (wherever applicable)
• Publicly usable:
  • untagged runners
  • no proxy configuration but support http_proxy/https_proxy/no_proxy
  • no custom CA certificate(s) but supports $CUSTOM_CA_CERTS or $DEFAULT_CA_CERTS to declare custom CA certificate(s)
  • internet hostnames/urls only
• Used Docker images:
  • public images
  • official images (when possible)
  • latest tag (when possible)
• Documented:
  • README.md documents the new feature
  • kicker.json describes the new feature
• Tested & examplified:
  • (url to a project sample successfully using the new feature) -> private repo