ci: enforce typecheck and add quality gates

Remove continue-on-error on the Typecheck step: astro check
currently reports 0 errors / 13 hints, so the step can block.

Also run tracking:check and image:budget after the build so these
quality gates actually fail CI when broken (they are defined in
package.json but were never wired into the workflow).

.github/workflows/ci.yml

@@ -21,13 +21,18 @@ jobs:
       - name: Install
         run: npm ci
 
-      - name: Typecheck (non-blocking — repo has known debt)
-        continue-on-error: true
+      - name: Typecheck
         run: npm run typecheck
 
       - name: Build
         run: npm run build
 
+      - name: Tracking check
+        run: npm run tracking:check
+
+      - name: Image budget
+        run: npm run image:budget
+
       - name: Notify ntfy on failure
         if: failure()
         run: |