ci: validate master after merge

Split out of #531, which is being closed in favour of smaller pieces.

## Idea

PR builds validate the *merge* commit, but nothing validates `master` after the merge actually lands. A merge that is individually green can still break master when it interacts with another merge that landed in between (semantic conflict — both PRs green, merge result broken).

#531 proposed adding a post-merge validation run on `master`.

## Why it was split out

#531 bundled three unrelated things:

1. `set -euo pipefail` on the seven `tsc | sed` type-check steps — **extracted to #630**, because it fixes a live correctness bug (type errors were passing CI green) and should not wait on a feature discussion.
2. This post-merge master validation feature.
3. ~4,150 lines of unit tests asserting properties of the YAML, against ~264 lines of actual pipeline change.

Item 1 was urgent and unrelated. This issue tracks item 2 on its own merits.

## Note on ordering

Post-merge master validation would have been largely pointless before #630: the master run would have inherited exactly the same `pipefail` blind spot, so its type-check steps would have been green regardless. #630 should land first.

## Open question

Whether the YAML-property unit tests from #531 are worth keeping in any form, or whether the pipeline is better validated by running it. Worth deciding before re-implementing.