Drift guards: sharpen the single-source rule and ship the shared-constants check #31

	# Thin launcher only — the logic lives in checks/ (see checks/README.md).
	name: Checks CI
	on:
	pull_request:
	push:
	branches: [main]
	defaults:
	run:
	shell: bash
	jobs:
	test-and-conformance:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	# Check out the PR's real head, not the synthetic refs/pull/N/merge commit
	# actions/checkout uses by default — otherwise HEAD is an ephemeral merge of
	# the branch into main, which the work-scoped squash-merge-history check would
	# (correctly, for that synthetic commit) flag. This makes CI evaluate exactly
	# what the local Stop hook does: the branch tip. Falls back to github.sha on push.
	ref: ${{ github.event.pull_request.head.sha \|\| github.sha }}
	- uses: actions/setup-node@v4
	with:
	node-version: 20
	- name: Unit tests
	run: node --test checks/test/*.test.mjs
	- name: Conformance sweep
	run: node checks/run.mjs

Provide feedback