Fix npm run lint and run it in CI

[dduugg]

Summary

Fixes npm run lint, which already fails on main, and runs it in CI so it can't silently break again.

• Prettier fix: .prettierrc sets singleQuote: true, which Prettier also applies to YAML. So prettier -c . flagged the double-quoted strings in .github/dependabot.yml, .github/workflows/codeql.yml and .github/workflows/zizmor.yml. The fix is prettier --write on those three files. Only the quoting changes; each file parses to the same YAML as before. The other workflows already use single quotes.
• Lint in CI: the build job runs npm run build:prod. Unlike npm run build, that has no prebuild hook, so neither ESLint nor Prettier ever ran in CI. The new lint job runs npm run lint once on Ubuntu, since neither tool's results depend on the OS.
  • It leaves out the build job's node_modules cache step: npm ci deletes node_modules before installing, so that cache never takes effect.

Required check

lint is now a required status check on main, next to the two build checks. It's pinned to the GitHub Actions app, like the Ubuntu build check. No other open PRs are affected. Any PR opened from a branch that predates this merge won't report lint until it's rebased onto main.

Test plan

• npm run lint passes locally; it fails on main.
• Each of the three reformatted files parses to identical YAML before and after.
• zizmor --offline .github/workflows/: no findings, same as main. The only new suppressed item is anonymous-definition (informational) for the unnamed lint job, which matches the unnamed build job.
• Fresh Eyes local review: no findings.
• CI passes, including the new lint job.