ci: fold two single-grep jobs into steps and call named pnpm scripts instead of inlined copies #1462

Context (verified 2026-07-28 against .github/workflows/ci.yml)

Two of ci.yml's 15 jobs consist of exactly checkout + one rg invocation each — ios-runner-swift-compat (lines ~25-38) and no-test-di-seams (~59-72) — paying full job scheduling/checkout overhead and two extra PR status-check lines for what are single grep assertions. They were bolted on independently (b79bd86, 9eb0604) with no documented reason to be jobs rather than steps.

Separately, three jobs inline byte-identical copies of commands that exist as named package.json scripts: the layering-guard step duplicates check:layering (ci.yml ~113-114), the depgraph step duplicates depgraph:test (~121), and the affected-selector step duplicates check:affected:test (~140) — silent-drift risk; maestro-conformance (~162) already does it right by calling pnpm maestro:conformance.

Caveat for the worker: before removing/renaming any job, check whether its name is a required status check in branch protection (not visible in-repo). If it is, either keep the job name on the merged job or flag the needed branch-protection edit in the PR for a human. Note the affected-selector job is intentionally zero-dep (R8 contract, commit e53f083) — calling pnpm check:affected:test there does NOT violate it (pnpm itself is provisioned regardless; R8 polices pnpm install, verify against scripts/layering/zero-dep-jobs.ts before assuming).

Acceptance criteria

• ios-runner-swift-compat and no-test-di-seams become named steps (each keeping its own failure message) in one static-checks job or prepended to lint; the two standalone jobs are removed. PR checks UI shows the same signal with fewer job lines.
• The three inlined command blocks are replaced by pnpm check:layering / pnpm depgraph:test / pnpm check:affected:test; run git grep to confirm no other workflow inlines a command that has a package.json name (fix any additional ones found the same way).
• R8 zero-dep gate (check:layering) still passes — the affected-selector job must not gain a pnpm install.
• Full CI green on the PR; no gate weakened (same commands ultimately execute).