perf(ci): split lint into its own fast-fail job (WP-30 #4)

New `lint` job (lint + format:check + check:tokens) runs in parallel with
`frontend`, reporting in ~5 min instead of waiting on the full
test:coverage/ng build --localize/npm audit chain. Depends on the item-1
node_modules cache (otherwise this would duplicate a full npm ci for no
speed benefit, per the WP's own note).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -16,6 +16,29 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # WP-30: split out of `frontend` so lint/format/token failures report in ~1 min instead of
+  # waiting on the full test:coverage/ng build below — depends on the node_modules cache
+  # above landing first, else this duplicates a full npm ci for no reason.
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+          cache: npm
+      - id: node-modules-cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: node_modules
+          key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+      - run: npm ci --prefer-offline --no-audit --no-fund
+        if: steps.node-modules-cache.outputs.cache-hit != 'true'
+      - run: npm run lint
+      - run: npm run format:check
+      - run: npm run check:tokens
+
   frontend:
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -34,13 +57,10 @@ jobs:
           key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
       - run: npm ci --prefer-offline --no-audit --no-fund
         if: steps.node-modules-cache.outputs.cache-hit != 'true'
-      - run: npm run lint
       # Bounded-context + atomic-layer boundaries (WP-38, dependency-cruiser).
       - run: npm run dep:check
       # Showcase snippets must match their real source regions (WP-39, no drift).
       - run: npm run gen:snippets && git diff --exit-code src/app/showcase/snippets.generated.ts
-      - run: npm run format:check
-      - run: npm run check:tokens
       # Runs the full suite AND reports coverage (WP-46, report-only — no thresholds, so
       # it can't fail on coverage; it still fails on a failing test, like `npm test` did).
       - run: npm run test:coverage