ci: improve cross-platform workflow

[JJordan0C]

Summary

Closes #15.

Reworks the CI workflow to give pull requests faster, clearer, and required
cross-platform feedback. Frontend validation is now isolated from Rust checks,
while Ubuntu, Windows, and macOS all run the platform validation before the
existing required aggregate check can pass.

Implementation

• Keep frontend-quality focused on frontend tests, type checking, linting,
  production build, and the reusable web-dist artifact.
• Run Rust formatting independently while the frontend job executes.
• Replace the conditional platform matrix with Ubuntu, Windows, and macOS for
  both pull requests and main pushes.
• Run Clippy on Ubuntu and Windows, then test and build the Rust workspace on
  every platform.
• Validate and package both product and benchmark plugins on every platform.
• Preserve the required checks (ubuntu-latest) context as a fail-closed
  aggregate over frontend, formatting, and every matrix job.

Validation

npm ci
PASS - 373 packages installed; npm reported 3 existing high-severity advisories.

npm test
PASS - 13 tests across 2 files.

npm run typecheck
PASS.

npm run lint
PASS.

npm run build
PASS - production bundle built from 1,965 transformed modules.

cargo fmt --all -- --check
PASS.

cargo clippy --locked --workspace --all-targets -- -D warnings
PASS - no issues found.

cargo test --locked --workspace
PASS - 408 passed, 1 ignored.

cargo build --locked --workspace
PASS.

cargo test --locked -p needle-platform-codex --test offline_n1
PASS - 6 passed.

cargo test --locked -p needle-platform-codex --test main_interrupt
PASS - 14 passed.

npm run test:e2e:local
PASS - 1 Playwright test passed.

cargo run --locked -p needle-app -- plugin validate
cargo run --locked -p needle-app -- plugin validate --benchmark
PASS - product and benchmark plugin validation passed.

cargo run --locked -p needle-app -- plugin package --output target/ci-product-plugin
cargo run --locked -p needle-app -- plugin package --benchmark --output target/ci-benchmark-plugin
PASS - both plugin packages were produced.

cargo run --locked --release -p needle-bench --bin proof-microbench
PASS - release microbenchmark completed and emitted schema needle.proof-microbench/1.

go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/ci.yml
PASS.

git diff --check
PASS.

GitHub-hosted Ubuntu and macOS execution was not available locally. The pull
request workflow is the authoritative cross-platform validation and timing
evidence for this CI-only change.

Risks/limitations

• Running all three platforms on every pull request increases total runner use;
  the jobs execute in parallel to limit critical-path impact.
• The legacy required context name checks (ubuntu-latest) is intentionally
  retained even though it now aggregates every platform.
• Before-and-after GitHub-hosted timings remain pending until this pull request
  completes its workflow.
• npm ci reports 3 existing high-severity advisories. Dependencies and the
  lockfile are unchanged by this pull request.

Documentation/evidence

No documentation or product-evidence change is required. Issue #15 records the
CI scope and acceptance evidence.

AI assistance and human verification

AI assistance: investigation, code, tests
Human verification: The repository owner reviewed the issue scope and validation summary, explicitly authorized this branch, commit, push, and ready-for-review pull request, and will use the GitHub-hosted workflow as the cross-platform verification. The local test results were produced in the shared checkout.

Ownership checklist

• I reviewed the complete scoped diff and can explain the material workflow changes.
• I reviewed the reported local validation and the remaining GitHub-hosted boundary.
• I explicitly authorized publication of the commit and this pull request.
• The change was checked for unrelated edits, credentials, generated files, and live artifacts.
• Documentation and PROJECT_STATUS.md were evaluated and are not affected by this CI-only change.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Punisheroot]

lgtm!