ci: run lint, test, and build on every PR

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+# A new push to the same branch makes the in-flight run obsolete.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: lint · test · build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # Node 24 LTS matches the Vercel production runtime. The repo pins no
+      # engines field, so this workflow is the de facto version of record —
+      # change both together if prod moves.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install
+        run: npm ci
+
+      # Errors fail the run; warnings don't. `eslint` exits 0 on warnings by
+      # design — add `--max-warnings=0` here once the existing 3 are cleared.
+      - name: Lint
+        run: npm run lint
+
+      - name: Test
+        run: npm test
+
+      # No secrets needed: src/env.ts validates ANTHROPIC_API_KEY lazily on
+      # first getClient() call, not at import or build time, so a keyless
+      # build is a real check rather than one that passes by accident.
+      - name: Build
+        run: npm run build