ci: detect stale typegen/codegen output

[fredericoo]

Context

From Kara's proposal in #headless-dev:

if it's possible to programmatically and deterministically check if something is in the state we need it to be in, we should ALWAYS add a CI check to scream at the PR author if it isn't acceptable

Problem

When a PR changes source code that affects generated files (typegen, codegen, etc.), the author may forget to re-run the generators. Reviewers can't easily tell if generated files are stale or intentionally changed.

Proposed solution

Add a CI step that:

1. Runs all generators (typegen, codegen, and any other file-generating commands)
2. Checks for unstaged changes via git diff --exit-code
3. Fails the build if any generated files differ from what's committed

This "define errors out of existence" approach catches the problem at CI time rather than relying on reviewers to notice.

Acceptance criteria

• CI step runs all generators in the repo
• Build fails with a clear error message if generated output differs from committed files
• Error message tells the author exactly which command to run