chore: harden CI with credential-free gate and bumped actions

[pinecone-groundskeeper]

Fixes #37

Problem

validate.yml's only PR gate was a single macos-latest job running Prettier (via npm run format + git diff --exit-code, which mutates the tree instead of just checking it) plus the full, credentialed integration-test job. Fork PRs have no access to the PINECONE_API_KEY secret, so they got a single pass/fail signal that mixed lint/format/typecheck with live network calls, on an unnecessarily expensive runner, using actions pinned two majors behind current.

Digging into ./.github/actions/setup, its "build" step ran npm run build, which is npm-run-all format lint && tsc — i.e. it silently reformatted the tree before the workflow's own Prettier check ran, so that check was comparing post-format output to itself and could never fail on real formatting violations.

Solution

• Split validate.yml into:
  • basic-hygiene: credential-free, runs on every PR including forks — npm run format:check, npm run lint, npx tsc (typecheck/build), then npm run test (unit + mocked layers from Add unit + mocked test coverage; make live tests self-skip without credentials #36; the live integration tests in the same suite self-skip without a key, so this is safe to run as-is).
  • run-integration-tests: gated with if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository so it only runs for pushes to main, manual/workflow_call dispatch, and same-repo PRs — never spends a runner on a fork PR that can't use the secret anyway. The suite's existing self-skip (from Add unit + mocked test coverage; make live tests self-skip without credentials #36) remains as a second line of defense.
• Removed the npm run build step from .github/actions/setup (install-only now) so nothing reformats the tree ahead of the explicit format:check/lint/tsc steps in basic-hygiene.
• Bumped actions/checkout, actions/setup-node, actions/cache from v3 to v4, and moved every job from macos-latest to ubuntu-latest (pure lint/build/test work, no macOS-specific need).
• Added a cache for the @xenova/transformers model download (node_modules/@xenova/transformers/.cache, keyed on the lockfile hash) on the two jobs that actually run live embeddings, to speed up repeat runs.

Verified locally (network-limited sandbox, onnxruntime-node's native-binary postinstall couldn't reach nuget.org, so installed with --ignore-scripts):

• npm run format:check → passes
• npm run lint → passes
• npx tsc → passes, no errors
• npm run test → 25 passed, 5 skipped (all 5 skipped are the live integration tests, confirming self-skip works with no PINECONE_API_KEY set)

User impact

Fork PRs (and any contributor without a Pinecone API key) now get a real, fast, credential-free green/red signal — typecheck, lint, format, and the unit/mocked test layers — instead of no signal or a build silently rewritten out from under the format check.

Follow-ups

None split off; #39 (dependency hygiene / major bumps) and #38 (workflow permissions, already merged) are tracked separately in the parent sweep, #41.

[jhamon]

This makes a lot of sense. No reason to use macos-latest runners because they add cost for no benefit here.