Fix CI: order steps by artifact dependency, resolve fresh-clone builds

CI failed at Lint with 1519 no-unsafe-* errors on every cross-package
import. Three fresh-checkout issues, invisible locally because lib/
persists between runs:

- Lint ran before Typecheck, but the type-aware ESLint config resolves
  vendor packages via their built declarations (tsconfig.typecheck.json
  -> vendor/*/lib), which Typecheck emits. Reordered.
- The first-ever tsc -b resolved sibling vendor plugins through their
  package.json types (lib/index.d.ts, not yet emitted) — TS2307 until a
  second run. The source-level paths map moves from the root
  tsconfig.json (dev-only, not inherited by package builds) into
  tsconfig.base.json so the whole build graph resolves source-first;
  tsconfig.typecheck.json still overrides wholesale to lib resolution.
- Hygiene ran publint (validates packed lib/index.js bundles) before
  Build emitted them. Reordered.

Also: checkout/setup-node bumped v4 -> v6 (node20 runners are
force-switched to node24 on 2026-06-16), the Build step name catches up
with tsdown, and AGENTS.md documents the one case where a fresh clone
needs `yarn typecheck` before `yarn lint`.

AGENTS.md

@@ -50,7 +50,11 @@ yarn demo           # run examples/echo-agent (needs --expose-internals, the
 
 Dev/test/demo run **unbuilt** via tsx + the `paths` map in the root
 `tsconfig.json` (`vitest` resolves through `tsconfig.test.json`). Building is
-only needed for publishing/consumption outside the repo.
+only needed for publishing/consumption outside the repo — with one exception:
+`yarn lint`'s type-aware rules resolve vendor packages through their built
+declarations (`tsconfig.typecheck.json` → `vendor/*/lib`), so run
+`yarn typecheck` once after a fresh clone (CI does the same) or lint reports
+unresolved-type `no-unsafe-*` errors.
 
 ## Conventions