Run every check on a push

There was no CI at all, and `bun run ci` is format and lint only — the
two suites and the typechecker were things you had to remember.

Two jobs rather than one. They fail for unrelated reasons, and only one
of them is slow: the browser suite has to build the client before it can
serve it, and a missing blank line should not wait behind Vite to be
reported.

The caches are keyed on what actually decides their contents. dprint on
the config that names its wasm plugins, Playwright on its own version
rather than the lockfile, which would discard a 180MB browser every time
an unrelated dependency moved. `--with-deps` runs either way, because
the browser is cached and the libraries it links against are not.

A failed browser run uploads its report and traces, which is the whole
of what makes a red tick actionable from a phone.