chore(ci): parallelize CI matrix + cache, tighten AI-facing quality gate

- ci.yml: 5-job matrix (typecheck/lint/format/build/test), fail-fast off,
  actions/cache on ~/.bun/install/cache + node_modules + ui/node_modules.
  Target wall time ~60-90s vs prior ~3-4min.
- .husky/pre-push: add bun run build:all to feature-branch fast gate so
  UI tsc -b errors are caught pre-push (~18s warm).
- CLAUDE.md (symlinked as AGENTS.md): fix validate drift (maintainability
  is NOT part of validate), add CI-First Protocol mandating gh pr checks
  --watch after every push, replace pre-commit checklist with two-tier
  model (iterative push vs pre-merge).

Branch protection on main/dev must be updated post-merge to require the
new matrix status checks instead of the single legacy "validate" check.

.github/workflows/ci.yml

@@ -4,35 +4,55 @@ on:
   pull_request:
     branches: [main, dev]
 
+# Design notes:
+# - Matrix parallelism cuts wall time from ~3-4min to ~60-90s (cache warm).
+# - Each matrix leg restores the same cache; `Ensure deps` fills gaps on cache miss.
+# - fail-fast: false so every failure is visible in one run (no re-pushing to see the next failure).
+# - Test leg runs build:all inline because it needs dist/ artifacts; still parallel with other legs.
+
 jobs:
   validate:
     runs-on: [self-hosted, linux, x64]
+    strategy:
+      fail-fast: false
+      matrix:
+        check:
+          - { name: typecheck, cmd: 'bun run typecheck' }
+          - { name: lint,      cmd: 'bun run lint' }
+          - { name: format,    cmd: 'bun run format:check' }
+          - { name: build,     cmd: 'bun run build:all' }
+          - { name: test,      cmd: 'bun run build:all && bun run test:all' }
+    name: ${{ matrix.check.name }}
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Clean stale artifacts
-        run: rm -rf node_modules ui/node_modules dist
-
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: '1.3.9'
-          no-cache: true
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '22'
 
-      - name: Install dependencies
+      - name: Restore bun + node_modules cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.bun/install/cache
+            node_modules
+            ui/node_modules
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock', 'ui/bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Ensure dependencies
         run: |
-          bun install --frozen-lockfile
-          cd ui && bun install --frozen-lockfile
+          [ -d node_modules ] || bun install --frozen-lockfile
+          [ -d ui/node_modules ] || (cd ui && bun install --frozen-lockfile)
 
-      - name: Build package
-        run: bun run build:all
-
-      - name: Validate (typecheck + lint + format + tests)
-        run: bun run validate
+      - name: Run ${{ matrix.check.name }}
+        run: ${{ matrix.check.cmd }}