run `checks.*.validate-*` in CI

[sellout]

They don’t run in Garnix or Nix CI because they’re not sandboxable. However, no reason we can’t create a GitHub workflow that runs them. Then we could re-enable Renovate’s automerge on this repo.