ci: run bun typecheck and tests for the two script packages on PRs

[deanrie]

Why

Two skills ship TypeScript scripts with their own test suites and typecheck configs: orchestrate/skills/orchestrate/scripts (209 tests across 28 files, tsc --noEmit) and pstack/skills/poteto-mode/scripts (63 tests across 5 files, tsc --project watch-pr/tsconfig.json --noEmit --strict). Nothing runs them in CI: .github/workflows/validate-plugins.yml only validates manifests. This is piece 4 of the shape in #531. #492 just added a worktree-audit test under the pstack package that, today, nobody executes after merge.

What

Adds .github/workflows/script-packages.yml: a matrix over the two package directories, oven-sh/setup-bun@v2, bun install --frozen-lockfile, then bun run typecheck and bun run test with working-directory set to the package. fail-fast: false so a failure in one package does not cancel the other. Triggers on PRs that touch either package or the workflow itself; the manifest validator keeps its own job.

Checked

Both packages green locally with bun 1.4.3 on current main:

orchestrate/skills/orchestrate/scripts: tsc ok, 209 pass, 0 fail
pstack/skills/poteto-mode/scripts:      tsc ok,  63 pass, 0 fail

--frozen-lockfile works against the committed bun.lock in both. Since the workflow file is in its own paths: list, the two jobs trigger on this PR as well; as a fork PR the run is sitting in action_required until a maintainer approves it, after which it is the first real execution.

Refs #531.

[deanrie]

Superseded by #618, which carries this commit together with the other two #531 CI pieces as one reviewable PR.