ci: split verification workflow checks

[ubugeeei]

Summary

• split the CI workflow into Web Check, Rust Check, and Build Packages and Apps jobs
• gate the heavier build job behind cheaper web/Rust validation to reduce wasted runner time on obvious failures
• keep pinned actions, explicit runners, scoped permissions, timeouts, and Node 24 runtime configuration intact

Verification

• vp check .github/README.md .github/workflows/ci.yml
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -color
• git diff --check
• vp run web:check
• vp run rust:check && cargo test --workspace
• vp run workspace:build

Closes #33