ci: isolate secrets from pull request checks

[Davidemulo]

Summary

• run lint, typecheck, and production builds for pull requests using only inert mock values
• restrict repository secret injection to trusted pushes on main
• remove private signing/deployment credentials and manual dispatch from CI
• keep least-privilege permissions, npm caching, concurrency cancellation, and add job timeouts

Security

Fork PRs receive no repository secrets and run no deployment steps. Secret values are never echoed or printed.

Validation

• npm ci
• npm run lint (passes with 2 pre-existing warnings)
• npm run typecheck
• secret-free npm run build
• workflow YAML parse and git diff --check

Closes #21

[Obiajulu-gif]

@Davidemulo great work, this look great