ci: validate master after merge

[RaananW]

Split out of #531, which is being closed in favour of smaller pieces.

Idea

PR builds validate the merge commit, but nothing validates master after the merge actually lands. A merge that is individually green can still break master when it interacts with another merge that landed in between (semantic conflict — both PRs green, merge result broken).

#531 proposed adding a post-merge validation run on master.

Why it was split out

#531 bundled three unrelated things:

1. set -euo pipefail on the seven tsc | sed type-check steps — extracted to fix(ci): fail type-check steps when tsc fails #630, because it fixes a live correctness bug (type errors were passing CI green) and should not wait on a feature discussion.
2. This post-merge master validation feature.
3. ~4,150 lines of unit tests asserting properties of the YAML, against ~264 lines of actual pipeline change.

Item 1 was urgent and unrelated. This issue tracks item 2 on its own merits.

Note on ordering

Post-merge master validation would have been largely pointless before #630: the master run would have inherited exactly the same pipefail blind spot, so its type-check steps would have been green regardless. #630 should land first.

Open question

Whether the YAML-property unit tests from #531 are worth keeping in any form, or whether the pipeline is better validated by running it. Worth deciding before re-implementing.