Separate linting into a standalone CI job

## Summary

Right now, linting runs as part of multiple CI test jobs (it's baked into `npm test` which chains `lint → test:unit → test:system`). That means every test suite re-runs the linter, adding a couple of minutes to each job for no real benefit since lint results don't change between runs.

## Suggestion

Pull linting out into its own standalone CI job and have the test jobs call `test:unit` / `test:system` directly instead of going through `npm test`.

The new job/workflow should be named generically so it can serve as a home for other scripts that only need to run once per CI run.

## Why

* Shaves a couple of minutes off each test job
* Saves GitHub Actions minutes by not running the same check multiple times
* Avoids redundant work across parallel jobs
* Gives us a clean place to add future one-shot checks without bloating the test matrix

Start by locating the GitHub Actions workflow and package scripts behind npm test, test:unit, and test:system. Trace how the current test jobs invoke npm test, then separate the lint command into a generic standalone CI job. Done means linting runs once per CI run while the unit and system jobs call their direct scripts and all checks pass.

Written by the indexing model from the issue text.