chore: modernize CI and add astro check

[magnus-madsen]

Summary

Modernizes the CI workflow and tightens up the build setup:

CI workflow

• Update actions/checkout v4 → v5 and actions/setup-node v4 → v6
• Test on Node 22.x and 24.x (current maintenance and active LTS lines)
• Add permissions: contents: read (least-privilege token)
• Add concurrency group that cancels superseded PR runs (master pushes always run to completion)
• Add a 5-minute job timeout and a workflow_dispatch trigger for manual runs
• Drop --if-present from the build step and fix the stale header comment

Type checking

• Add astro check as a CI step with @astrojs/check + typescript devDependencies and a minimal tsconfig.json extending astro/tsconfigs/base — currently passes with 0 errors/warnings across all 18 files

Reproducible builds

• Pin the flix.tmLanguage.json fetch to a specific commit of flix/textmate instead of tracking master HEAD; bump the SHA in build-scripts/fetchGrammar.mjs to pick up grammar changes

Housekeeping

• Declare engines: { node: ">=22" } and add .nvmrc so contributors get warned/switched to a compatible Node
• Remove stale /src/data entry from .gitignore

Test plan

• npm run check passes locally (0 errors, 0 warnings, 0 hints)
• npm run build builds all 9 pages cleanly with the pinned grammar URL
• CI green on this PR across the Node 22/24 matrix

🤖 Generated with Claude Code