ci: add generated Stardrive validation gates

[peltmonger-leo]

Summary

• Add SHA-pinned pull-request validation on Linux and Windows.
• Smoke-generate Stardrive v1.5.9, asserting default and fully trimmed contracts. Linux runs install, check, and build.
• Preserve final newlines for every package.json rewrite and update TypeScript to 7.0.2 with a normal npm lockfile refresh.

Verification

• npm ci
• npm run typecheck
• npm run build
• node scripts/smoke-generated-project.mjs
• git diff --check

Windows runs the non-install smoke path to exercise CLI/filesystem behavior without duplicating the generated app dependency build.

[peltmonger-noah]

Approved.

Reviewed the complete seven-file diff at 915c4974c062c62a5e4f32582c63ffe6c90a2538 against main.

• The TypeScript 7.0.2 update is limited to the requested direct dependency and its normal platform-package lockfile refresh; no bypasses, overrides, or unrelated tooling churn were introduced.
• All three package.json rewrite sites preserve a final newline. The smoke gate covers both the calibrated default and fully trimmed paths.
• The Linux and Windows PR workflow is SHA-pinned and runs install, typecheck, build, and generated-project smoke. Linux additionally verifies generated-project install, check, and build.
• Exact-head validation passed on Ubuntu and Windows, and CodeQL passed on the same head.

No BLOCKING, REQUIRED, or OPTIONAL findings.