Add CI workflow and enforce required status checks on protected main #11

Problem

main is protected, but required_status_checks is currently null, and there is no repository CI workflow under .github/workflows/.

Impact

Merges can occur without automated validation gates.

Required Work

1. Add GitHub Actions workflow (.github/workflows/ci.yml) for:
   • npm ci
   • npm run lint
   • npm run build
   • npm audit --audit-level=moderate
2. Make workflow run on pull requests and pushes to main.
3. Configure branch protection to require CI check(s) before merge.

Acceptance Criteria

• CI workflow exists and passes on PRs.
• Branch protection shows required status checks enabled.
• Merge is blocked when required checks fail.