build(scripts): convert every remaining .mjs/.d.mts pair to real .ts

Same motivation as the prior commit, extended to scripts/: a hand-maintained
.d.mts alongside a .mjs is exactly the duplicated-declaration problem the
TypeScript migration was supposed to eliminate, and it can silently drift
from the real implementation with no compiler ever checking it. Converts
all 39 remaining scripts/*.mjs files that had one -- the mcp-release/
orb-release family, every docs/settings/schema drift checker, and the rest
of the standalone generators -- to real .ts, inferring each function's
types from its actual behavior rather than trusting the old declaration,
per the pattern proven out on the miner/mcp packages. Nothing in scripts/
was ever part of Codecov's coverage surface, so this adds no coverage
obligation; it's a straight type-safety and drift-elimination win.

Real drift the old .d.mts files had already accumulated, found while
converting:
- check-schema-drift.ts read a table's name via SQLiteTable.Symbol.Name,
  an @internal drizzle-orm symbol never in its public type exports (which
  is exactly why the old hand-written declaration typed it without
  complaint) -- switched to the public getTableName().
- ci-duration-report.ts's WorkflowRun type was missing the `event` field
  the code actually filters on.
- orb-release-core.ts's IMAGE_RELEVANT_PREFIXES still named two sibling
  scripts by their old .mjs filenames, now renamed here too -- a commit
  touching either file under its real name would have silently stopped
  counting as image-relevant.

Every consumer updated to match: .js-suffixed import specifiers (Vite/
esbuild/Wrangler already resolve these to the sibling .ts, same as the
prior commit), test imports, and every real invocation site. A script
whose own file stays .mjs but now imports something converted here (e.g.
check-mcp-package.mjs importing forbidden-content.ts) needs tsx instead
of plain node, since only tsx (not node --experimental-strip-types)
resolves a same-directory .ts import transitively; a script with zero
local imports uses --experimental-strip-types directly, cheaper than
spawning tsx. Covers every affected npm script, the three release-watch
GitHub workflows (which previously needed no npm install at all --
added ./.github/actions/setup-workspace to each), the Dockerfile, and
deploy-selfhost-prebuilt.sh.

That last category caught two live regressions already sitting on this
branch from the prior commit, beyond the one this commit's own
check-miner-deployment-docs.ts conversion fixes (that one's what's been
failing this PR's own CI): packages/loopover-miner/scripts/
generate-env-reference.mjs (npm run miner:env-reference, part of
test:ci) and the Dockerfile/deploy-selfhost-prebuilt.sh's
validate-selfhost-sourcemap invocations were both silently broken the
same way -- caught by grepping for every remaining literal .mjs
reference to a converted filename repo-wide, not by any test, since the
one existing test for the miner env-reference generator imports it
through Vite (which already tolerates the mismatch) rather than
spawning it as the real subprocess the npm script actually runs.

Author: JSONbored

scripts/gen-selfhost-env-reference.ts

@@ -16,9 +16,9 @@ export const DEFAULT_SOURCE_ROOTS = [
   "src/services/ai-review.ts",
   "src/queue/ai-review-orchestration.ts",
   "src/queue/processors.ts",
-  "scripts/build-selfhost.mjs",
+  "scripts/build-selfhost.ts",
   "scripts/migrate-selfhost-sqlite-to-postgres.ts",
-  "scripts/smoke-observability-traces.mjs",
+  "scripts/smoke-observability-traces.ts",
 ];
 
 const ENV_NAME_RE = /^[A-Z][A-Z0-9_]*$/;