chore(repo): one canonical way to run the checks

[JArmandoAnaya]

Two background invocations of uv run pytest -q | tail -20 reported exit 0 during the #229–#233 run while the suite was failing. A pipeline's status is the last command's, so tail succeeding at printing lines masked pytest failing at running them — and a real broken test survived two task cycles.

scripts/check.sh is the fix, and the place the rule now lives.

bash scripts/check.sh                  # python + frontend + generated
bash scripts/check.sh python           # one group
pnpm check                             # the same script, from the other half

It carries set -euo pipefail, and it collects every failure rather than stopping at the first — knowing that lint and a test are broken is one round trip where learning it twice is two.

Decisions taken

A script, not a Makefile. This repository has never had make, and scripts/build_dist.sh / scripts/cycle_server.sh are the established shape for "several commands whose order or failure handling matters". Adding a second tool convention to hold four lines of dispatch is not worth it.

What it does not run is stated rather than implied. The wheel build, the 30-minute flow, the format smoke tests (ultralytics brings torch) and everything Playwright stay in CI, because each costs minutes or needs its own install. CONTRIBUTING.md's table is still the full list and now carries an In check.sh column — including for the rows covered indirectly, so pnpm -r lint running the annotator boundary gate and uv run pytest running the wire-fixture gate are visible rather than assumed.

The generated group mirrors each artifact's real mechanism instead of inventing a uniform --check they do not have. openapi.json has no check mode, so it regenerates and diffs exactly as CI does — a side effect worth knowing about, since a stale spec is left corrected in the working tree. tests/fixtures/wire_annotations.json is deliberately absent: its gate is tests/server/test_wire_fixtures.py, which the python group already runs.

A missing node_modules is refused up front, with a sentence naming pnpm install. Found while testing this in a fresh worktree: otherwise the first thing you see is ERR_MODULE_NOT_FOUND: openapi-typescript under a nine-line node stack, which reads as "the generated client is broken" rather than "nothing is installed" — and a fresh worktree is exactly where somebody runs this first.

Verification

The original bug, reproduced and then caught. A deliberately failing test:

--- old habit: pipe through tail ---
FAILED tests/kernel/test_zz_mutation_probe.py::test_deliberately_broken_for_a_mutation_check
PIPELINE_EXIT=0          # <- the bug

--- the script ---
SCRIPT_EXIT=1
    FAILED (python tests, exit 1)
FAILED: python tests

All three groups run green on this branch (python, frontend, generated).

Not in this PR

The same rule was added to the local CLAUDE.md, which is git-excluded and must never be committed. The committed home for it is CONTRIBUTING.md, above the check table.