chore(protocol-core): declare lint dependencies and typecheck scripts/

[henrypalacios]

Summary

• Declare the dependencies the root ESLint flat config imports, so pnpm -r lint runs across the workspace.
• Bring packages/protocol-core/scripts/ under both lint and typecheck.
• Add a typecheck script, a root typecheck that recurses like lint, and a CI step so it runs alongside Lint and Build.

Changes

File	Change
package.json	Declare @eslint/js, typescript-eslint, and typescript. The flat config at the repo root imports the first two, and Node resolves a config file's imports relative to that file, so they belong in the root manifest; typescript is a non-optional peer of typescript-eslint. Add the recursive typecheck script.
packages/protocol-core/package.json	Declare eslint so the package's lint script resolves its own binary, and @types/node so the validation script's Node globals come from a stated dependency. Widen lint to src/ scripts/; add typecheck (tsc --noEmit -p tsconfig.json).
packages/protocol-core/tsconfig.json	include now covers scripts alongside src, so the address validation script is type-checked and reachable by the type-aware lint rules.
packages/protocol-core/tsup.config.ts	Point the build at the existing tsconfig.build.json, so it keeps its own input list rather than following the tsconfig the typecheck widens.
.github/workflows/CI.yml	Add a blocking Typecheck step between Lint and Build.
pnpm-lock.yaml	Records the new declarations and moves eslint to the newest 9.x.

Build output

dist/ is unchanged — same six files, same byte sizes, identical SHA-256:

4832   dist/index.d.mts     caaa6690f13752877e70ba2d749459d74c97e3b92ba8ba811f9329ff070b95c2
4832   dist/index.d.ts      caaa6690f13752877e70ba2d749459d74c97e3b92ba8ba811f9329ff070b95c2
11345  dist/index.js        3dde65b56386a643d3284b6ca45915dabb6d77061b48f375a84e9263368482aa
25451  dist/index.js.map    62a88339e904832a7799ad03e4ceab4ffb020a91f98b899439e304113d86eeba
10691  dist/index.mjs       ce5d74e01c7347c58888f2261421f23520bf24207d95be5daf76dc336fb15f6a
25450  dist/index.mjs.map   f888fd19d9cc836b56df0be406173503aea981d037a12e2883083907a1645b9f

The tsup tsconfig pin is deliberately a no-op for output: the bundle is defined by entry: ['src/index.ts'], and a build with the pin removed produces the same six checksums. npm pack --dry-run still lists only README.md, package.json, and the six dist/ files.

Test plan

Run from packages/protocol-core unless noted.

• pnpm lint — exit 0
• pnpm typecheck — exit 0; --listFiles confirms scripts/validate-addresses.ts is in the program
• pnpm test — 9 files, 154 tests passed
• pnpm build — exit 0; dist/ checksums unchanged
• pnpm validate:addresses — 44 addresses validated across 11 chains
• Root pnpm -r lint — exit 0, both packages
• Root pnpm -r typecheck — exit 0; packages/sdk has no typecheck script and is skipped
• pnpm install --frozen-lockfile — exit 0

Scope

Configuration and dependency declarations only. No src/ logic and no version change. The only CI.yml edit is the added Typecheck step.