Added mirror gscan CI workflows for themes

Added subtree-persisted workflow files under each theme package so standalone mirror repositories run `pnpm zip` and fatal `gscan` before Renovate or direct PRs can be considered passing. Documented that these package-local workflows are for mirror repositories, while monorepo package validation remains owned by the existing root workflows.

Author: aileen

.github/workflows/test.yml

@@ -0,0 +1,43 @@
+name: Test
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - 'renovate/*'
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+
+      - run: pnpm install --no-frozen-lockfile
+
+      - run: pnpm zip
+
+      - run: pnpm exec gscan --fatal --verbose .
+
+  all-tests-pass:
+    name: All tests pass
+    if: always()
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify all required jobs succeeded
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1