The Lint → Test → Security pattern keeps each stage to a single concern.
`npm run build` belonged to test only to publish a PR-preview artifact;
release.yml already handles production builds, and developers can run
`npm run build` locally. Removing it from the test stage:
- aligns with code-standards/ci/pipeline-structure.md
- shaves ~70s off PR CI time
- removes the "dist" artifact upload (coverage upload stays)