Add an are-the-types-wrong check to CI

[camcima]

From the improvement opportunities of the 2026-08 architecture review.

Problem

The package ships dual ESM/CJS output built by tsup, with a conditional exports map carrying per-condition types (dist/index.d.ts for import, dist/index.d.cts for require). Review found this setup correct — but nothing in CI keeps it that way.

Dual-format type resolution is the classic place where a package silently breaks for a subset of consumers: a wrong condition order, a missing .d.cts, or a moduleResolution: node16 mismatch produces a package that installs fine and resolves types to any (or fails outright) only for users on the other module system. The existing Verify publishable tarball job checks that a tarball can be produced, not that its type entry points resolve under each resolution mode.

This is cheap insurance for a library whose main selling point is its type surface.

Proposed direction

Add @arethetypeswrong/cli against the packed tarball, next to the existing tarball verification job:

npm pack
npx --yes @arethetypeswrong/cli --pack .

Run it on the same Node version as the other publish-adjacent checks and fail the build on regressions. Worth pairing with publint in the same step, which catches complementary package.json packaging mistakes.

Acceptance criteria

• CI fails if either module system resolves types incorrectly.
• Check runs against the packed artifact, not the source tree.
• Documented in CONTRIBUTING.md alongside the other quality gates.