ci: shave dead-weight checkout + cache TypeScript incremental builds

[JSONbored]

Summary

• Dead-weight full-history checkout in validate-code: its Codecov upload steps moved to validate-tests in ci: shard the full-suite coverage run across a matrix #4815, but the fetch-depth: 0 it needed for that stayed behind. Measured ~3s of pure waste per run (5s full-history checkout vs 2s shallow, same repo).
• TypeScript incremental build caching: enables tsc's own --incremental mode and caches .tsbuildinfo across validate-code runs. Measured ~13.5s cold vs ~3.6s warm locally on this codebase's typecheck -- a real cut on a step that runs unconditionally on every backend-touching PR. Uses the run_id-suffixed-key + restore-keys-prefix pattern (not the hit-or-miss pattern node_modules caching uses elsewhere in this job) since .tsbuildinfo mutates every run rather than being immutable per lockfile.
• Resolved a question, no code change needed: added a temporary nproc diagnostic to a shard job to check whether --maxWorkers=4 actually matches the real runner's vCPU count, or whether free parallelism was being left on the table. Confirmed 4 -- already exactly matched, no headroom there. Diagnostic removed now that it's answered.

Why

Follow-up "squeeze CI without adding more shards" pass after #4944. This was originally going to be one commit on #4944 but didn't make it into that squash-merge, so it's a standalone PR.

Correctness

For the incremental-typecheck change specifically: introduced a deliberate type error locally with a warm incremental cache present, confirmed tsc still reports it (real exit code 1); confirmed a clean tree still exits 0 after removing it. tsc verifies each file's content hash before trusting cached state, so a fresh CI checkout's reset mtimes can't produce a false cache hit that masks a real error.

Test plan

• npx tsc --noEmit clean (both cold and with a warm incremental cache)
• npm run actionlint clean
• YAML parses
• Verified nproc on a real shard runner: 4, matching --maxWorkers=4
• Verified incremental-cache correctness with a deliberate type-error injection/removal cycle

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.24%. Comparing base (6954202) to head (832da5f).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4951   +/-   ##
=======================================
  Coverage   94.24%   94.24%           
=======================================
  Files         445      445           
  Lines       38869    38869           
  Branches    14157    14157           
=======================================
  Hits        36633    36633           
  Misses       1577     1577           
  Partials      659      659           

Flag	Coverage Δ
shard-1	46.75% <ø> (ø)
shard-2	33.29% <ø> (ø)
shard-3	31.41% <ø> (ø)
shard-4	33.00% <ø> (ø)
shard-5	33.47% <ø> (ø)
shard-6	45.23% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.