Clean release snapshot

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+# Reusable CI checks (typecheck + npm audit). Invoked by ship-ci.yml's `CI`
+# job for PRs into main and release/** so the check run is named "CI / check",
+# matching the org rulesets' required context. It deliberately has no
+# standalone pull_request trigger: a direct run would publish a bare "check"
+# that the rulesets can't match.
+on:
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Read build configuration
+        id: config
+        shell: bash
+        run: |
+          NODE_VERSION=$(node -p "require('./.build-config.json').versions.node")
+          echo "node=$NODE_VERSION" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.config.outputs.node }}
+
+      # No package-lock.json in this repo — npm ci is not available.
+      - name: Install npm dependencies
+        run: npm install
+
+      - name: TypeScript type check
+        run: npm run typecheck
+
+      - name: npm audit
+        run: npm audit --audit-level=high
+        continue-on-error: true