ci: add PR-triggered CI workflow (#44)

Adds a CI workflow running on pull_request and push to main so automated
checks gate every code change (Vanta: github-code-change-automated-checks-enabled).

Claude-Session: https://claude.ai/code/session_01LYL1ivhJKNwnHRCdTSuAom

Author: asachs01

.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [22.x, 24.x]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install dependencies
+        run: npm ci
+
+      # NOTE: `npm run lint` is omitted — the repo has a legacy .eslintrc.cjs
+      # with ESLint >=9 installed, so eslint exits 2 until the config is
+      # migrated to eslint.config.*. Type checking still runs below.
+
+      - name: Run type check
+        run: npm run typecheck
+
+      - name: Build
+        run: npm run build
+
+      - name: Run tests
+        run: npm test