CI: type-check evals in CI, and stop double-running the matrix on every PR

Summary

The CI (.github/workflows/non-windows.yml, .github/workflows/windows.yml) is solid — it runs npm ci + npm test + npm run build across macOS/Ubuntu/Windows, smoke-checks native modules, and packages + verifies the Windows installers. But there are two concrete gaps worth closing. Neither is urgent; the pipeline is correct, it's just missing one guard and doing redundant work.

Gap 1 — evals/ is never type-checked in CI

Root cause. The root tsconfig.json only includes src, common, electron:

"include": ["src", "common", "electron", "vite.config.ts"]

npm run build is tsc --noEmit && vite build, which uses that root config, so evals/ is outside the compiled set. The only thing that type-checks the evals is the separate npm run typecheck:evals (tsc --noEmit -p evals/tsconfig.json), and that script is not run by either workflow. npm test only executes a hand-listed set of *.test.ts files, none under evals/.

Impact. A type error introduced in evals/ (scenarios, harness, scoring, seeding) passes CI green. This is a live risk — the eval scenarios are edited fairly often (e.g. the recent Cowork skill-builder scenarios in evals/skillbuilder/scenarios.ts).

Suggested fix. Add one cheap step to the Linux leg of the non-Windows workflow (a few seconds, no need to run it on every OS):

- run: npm run typecheck:evals

Gap 2 — every PR runs the whole matrix twice

Root cause. Both workflows trigger on push and pull_request:

on:
  push:
  pull_request:

For a PR whose branch lives in this repo, both events fire on each commit, so the entire matrix (macOS, Ubuntu, Windows x64, Windows arm64 — the last two including the slow electron-builder packaging step) runs twice per commit. (Easy to see in a recent PR: two separate workflow runs per job.)

Impact. ~2× CI minutes/wall-clock on every PR push, dominated by the duplicated Windows packaging jobs.

Suggested fix. Either scope the triggers so a branch with an open PR isn't built twice, e.g.:

on:
  push:
    branches: [master]
  pull_request:

and/or add a concurrency group that cancels superseded runs:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Notes

• Evals themselves (npm run eval:*) should not run in CI — they need a model/network and cost money. This issue only asks for the cheap type-check of the evals, not their execution.
• No linter exists in the repo today, so "no lint in CI" is out of scope here.

Ported from https://github.com/adilei/skill-recorder/issues/36 (originally opened by @adilei on 2026-07-28).

Start with .github/workflows/non-windows.yml and .github/workflows/windows.yml, then inspect the root package scripts and evals/tsconfig.json. Run npm run typecheck:evals locally and review the workflow triggers and concurrency settings. Done means evals type-check in the Linux CI leg and pull requests no longer cause redundant matrix runs.