ci: fail on format drift, freeze installs, and fix turbo cache keys

[PunGrumpy]

Why

Four gaps let CI report green without proving anything:

• The Format job ran `bun run fix`, a mutator that always exits 0. Unformatted code merged green.
• `bun install` ran unfrozen, so CI never validated the committed `bun.lock`.
• Turbo cached `next build` without hashing `NEXT_PUBLIC_API_URL`. Changing the API URL could replay a cached bundle that still pointed at the old URL.
• Turbo saw `@pigo/api` as a leaf package. Editing `packages/core/*.go` returned cache hits for the api build and test, so the replayed binary was built from the old core and the replayed test never ran.

What changed

• Format job now runs `bun run fix && git diff --exit-code`, so a formatting diff fails the build.
• Both workflows install with `--frozen-lockfile`.
• `turbo.json` declares `env` for the build task (`NEXT_PUBLIC_API_URL`, `NEXT_PUBLIC_VERCEL_PROJECT_PRODUCTION_URL`, `VERCEL`, `VERCEL_ENV`).
• `apps/api/package.json` gains a `workspace:*` dependency on `@pigo/core`, and a new `apps/api/turbo.json` adds the core Go sources to the build/test/typecheck cache inputs.
• code-quality workflow gains a concurrency group with cancel-in-progress, a Bun install cache keyed on `bun.lock`, and drops the unused Node setup step.

Verification

• `bun install --frozen-lockfile`, `bun run check`, `bun run typecheck`, `bun run test`, and `bun run fix && git diff --exit-code` all exit 0.
• Turbo dry-run hash for `@pigo/api#test` changes when `packages/core/resize.go` changes and reverts with it.
• Turbo dry-run hash for `web#build` changes when `NEXT_PUBLIC_API_URL` changes.
• `bun run typecheck` and `bun run test` pass with Node removed from PATH, confirming the dropped setup step was unused.

Note: this branch and the test-environment branch both touch `bun.lock`; whichever merges second needs a trivial rebase.

[changeset-bot]

⚠️ No Changeset found

Latest commit: bc7a17c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pigo	Ready	Preview	Aug 30, 2026 2:00am
pigo-api	Ready	Preview	Aug 30, 2026 2:00am