ci: consolidate Node + pnpm install across 4 TS jobs into composite action

[countercheck]

Source: codebase audit, 2026-06-11 (audit finding F10, Tier 3)
Severity: Low
Category: CI maintainability

Problem

The four TypeScript jobs (`ts-lint`, `ts-typecheck`, `ts-test`, `ts-build`) in .github/workflows/ci.yml:110 each independently run:

1. `actions/setup-node`
2. `corepack enable`
3. `pnpm install --frozen-lockfile`

That's ~30s × 4 = ~2 minutes of repeated setup per CI run.

Suggested approach

Two options:

1. Composite action at `.github/actions/setup-frontend/action.yml` encapsulating the three steps; each job calls `uses: ./.github/actions/setup-frontend`.
2. Single setup job that uploads `node_modules` as an artifact, with later jobs depending on it via `needs:` + `actions/download-artifact`. Slightly more complex but saves the pnpm install entirely on the later jobs.

Option 1 is simpler and probably enough.

Verification

CI green; total wall-clock should drop by ~1.5 min/run.

Priority

Convenience, not correctness. Worth doing when CI feedback time becomes a friction point.