fix(ci): run extension typecheck/lint inside the lint gate (#1182)

[jayminwest]

Summary

Closes #1182.

Each extensions/* package declares its own typecheck (all six) and lint (two) scripts, but the root tsconfig.json and biome.jsonc exclude extensions/ and CI only ran ext:install. extensions/campaign-controller sat at 15 tsc errors and 8 biome errors on main while every gate stayed green.

This PR follows the sequence the issue suggests: repair campaign-controller first, then add the gate so it lands green.

Campaign-controller repair

• ActionErrorClass gains "dispatch_rejected". Two call sites already persisted that value.
• FollowUpStoreDeps types errorClass as ActionErrorClass and declares requireProgress on the followUps seam, matching the real FollowUpStore.
• branch-freshness.ts narrows the nullable branchUpdater once before the closure, and adapts the transport's { message } result to the MutationIoResult the journal expects.
• FollowUpStore.#update binds SQLQueryBindings instead of unknown.
• Test-side drift: real TickCommandDeps in tick-command.test.ts (replacing an unused GRAMMAR constant), the dispatch recorder shape and outcome narrowing in branch-freshness.test.ts, unused imports in the e2e test, plus biome import ordering and formatting in three files.

Extension tests: 487 pass, unchanged.

The gate

scripts/check-extensions.ts discovers every extensions/* package, runs the typecheck and lint scripts it declares (skipping any it does not), and fails with a cd extensions/<x> && bun run <gate> hint on the first red one. A missing node_modules gets bun install --frozen-lockfile first, so a fresh clone's bun run verify does not fail on a resolution error.

It rides inside bun run lint because the 12-gate manifest is frozen, and a CI-only step would leave local bun run verify green while an extension is broken. Also runnable standalone as bun run check:extensions.

• ci.yml moves ext:install ahead of lint.
• scripts/ci-parity-config.json updates the ext:install justification.
• AGENTS.md lists the guard as the tenth lint-riding guard.
• scripts/check-extensions.test.ts covers discovery and the runner through a spawn seam.

Verification

• bun run check:all: 12/12 gates pass.
• Stashing the campaign-controller repair and re-running bun run check:extensions fails with both typecheck and lint named, so the guard catches the exact state main was in.