feat(review-platform): add GitHub CLI auth and workspace context mode

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,49 @@
+name: Bug report
+description: Report a reproducible bug or regression.
+title: "[Bug]: "
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What went wrong, and what did you expect instead?
+      placeholder: Briefly describe the bug and the expected behavior.
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Desktop app
+        - Web UI
+        - Mobile web
+        - Agent runtime / core
+        - AI provider / model adapter
+        - Remote workspace / relay
+        - Installer / packaging
+        - Documentation
+        - Not sure
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction or evidence
+      description: Steps, screenshots, logs, or a short recording. Remove tokens, keys, user IDs, and private data.
+      placeholder: |
+        1. Open ...
+        2. Click ...
+        3. Observe ...
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment, if relevant
+      description: Include the version, commit, OS, browser, desktop/mobile device, model/provider, or deployment mode if relevant.
+      placeholder: |
+        BitFun version/commit:
+        OS:
+        Browser/device:
+        Model/provider:

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/GCWing/BitFun/security/advisories/new
+    about: Please report security issues privately instead of opening a public issue.

.github/ISSUE_TEMPLATE/docs.yml

@@ -0,0 +1,19 @@
+name: Documentation issue
+description: Report missing, outdated, confusing, or incorrect documentation.
+title: "[Docs]: "
+body:
+  - type: textarea
+    id: location
+    attributes:
+      label: Documentation location
+      description: Link the page or file path if known.
+      placeholder: README.md, CONTRIBUTING.md, docs/..., website page, etc.
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or suggested update
+      description: What is missing, outdated, confusing, or incorrect? Include suggested wording if you have it.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,46 @@
+name: Feature or product proposal
+description: Suggest a user-facing feature, workflow improvement, or product direction.
+title: "[Feature]: "
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / opportunity
+      description: What user problem, workflow gap, or product opportunity should this address?
+      placeholder: Describe the current pain point and who experiences it.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: What should BitFun do differently?
+      placeholder: Describe the desired behavior or workflow.
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Product surface
+      options:
+        - Desktop app
+        - Web UI
+        - Mobile web
+        - Agent runtime / core
+        - AI provider / model adapter
+        - Remote workspace / relay
+        - Installer / packaging
+        - Documentation
+        - Cross-cutting
+        - Not sure
+    validations:
+      required: true
+  - type: textarea
+    id: details
+    attributes:
+      label: Details, examples, or constraints
+      description: Optional. Include acceptance criteria, screenshots, alternatives, risks, or compatibility concerns.
+      placeholder: |
+        - Users can ...
+        - The UI shows ...
+        - It works when ...

.github/pull_request_template.md

@@ -0,0 +1,33 @@
+## Summary
+
+<!-- Briefly describe what changed. -->
+
+Fixes #
+
+## Type and Areas
+
+Type:
+
+<!-- Feature / bug fix / regression fix / refactor / UI/UX / docs / test / CI / dependency / other. -->
+
+Areas:
+
+<!-- Rust core, desktop/Tauri, web UI, mobile web, server/relay, AI adapters, installer, docs, etc. -->
+
+## Motivation / Impact
+
+<!-- What problem does this solve, and what changes for users or developers? Write "No direct user-facing change" if applicable. -->
+
+## Verification
+
+<!-- List exact commands, manual checks, and outcomes. For docs-only or template-only changes, use the lightest relevant checks or explain why runtime checks were skipped. -->
+
+## Reviewer Notes
+
+<!-- Optional: screenshots, architecture notes, compatibility risks, migration notes, or rollback guidance. -->
+
+## Checklist
+
+- [ ] This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
+- [ ] Relevant verification is recorded above, or skipped checks are explained.
+- [ ] User-facing strings, docs, and locales are updated where applicable.

.github/workflows/ci.yml

@@ -21,6 +21,40 @@ permissions:
   contents: read
 
 jobs:
+  # ── CLI: independent tests ─────────────────────────────────────────
+  cli-test:
+    name: CLI Tests (ubuntu-latest)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Linux system dependencies
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            pkg-config \
+            build-essential \
+            libssl-dev \
+            libxcb1-dev \
+            libxcb-render0-dev \
+            libxcb-shape0-dev \
+            libxcb-xfixes0-dev
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Generate dependency lockfile
+        run: cargo generate-lockfile
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          shared-key: "cli-ci-v2-ubuntu"
+          cache-bin: false
+          save-if: ${{ github.event_name != 'pull_request' }}
+
+      - name: Run CLI tests
+        run: cargo test --locked -p bitfun-cli
+
   # ── Rust: build check ─────────────────────────────────────────────
   rust-build-check:
     name: Rust Build Check (${{ matrix.os }})
@@ -34,15 +68,15 @@ jobs:
           - macos-15
           - windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Setup OpenSSL (Windows, prebuilt)
         if: runner.os == 'Windows'
         shell: pwsh
         run: ./scripts/ci/setup-openssl-windows.ps1
 
       - name: Download frontend build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: frontend-dist
           path: dist
@@ -84,16 +118,21 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
 
+      - name: Generate dependency lockfile
+        run: cargo generate-lockfile
+
       - uses: swatinem/rust-cache@v2
         with:
           shared-key: "ci-check-v2-${{ runner.os }}-no-cargo-bin-v1"
           cache-bin: false
+          # PR caches are scoped to merge refs; main pushes own shared cache refreshes.
+          save-if: ${{ github.event_name != 'pull_request' }}
 
       - name: Check compilation
-        run: cargo check --workspace --exclude bitfun-cli
+        run: cargo check --locked --workspace
 
-      - name: Run core Rust tests
-        run: cargo test --locked -p bitfun-core
+      - name: Run core and desktop Rust tests
+        run: cargo test --locked -p bitfun-core -p bitfun-desktop
 
   # ── Frontend: build ────────────────────────────────────────────────
   frontend-build:
@@ -102,27 +141,70 @@ jobs:
     env:
       NODE_OPTIONS: --max-old-space-size=6144
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 2
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
-          node-version: 20
+          node-version: 22
           cache: pnpm
 
+      - name: Check repository hygiene
+        run: pnpm run check:repo-hygiene
+
+      - name: Check core boundaries
+        run: node --test scripts/check-core-boundaries.test.mjs
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Validate GitHub config
+        run: pnpm run check:github-config
+
+      - name: Select i18n contract profile
+        shell: bash
+        run: |
+          if git rev-parse HEAD^1 >/dev/null 2>&1 &&
+            git diff --name-only HEAD^1 HEAD -- scripts/i18n-audit.mjs scripts/i18n-contract.test.mjs | grep -q .; then
+            echo "BITFUN_I18N_CONTRACT_TEST_AUDIT_INTEGRATION=1" >> "$GITHUB_ENV"
+          fi
+
+      - name: Validate i18n contract
+        run: pnpm run i18n:contract:test:ci
+
+      - name: Audit i18n resources
+        run: pnpm run i18n:audit
+
+      - name: Validate theme color audit contract
+        run: pnpm run theme:color-audit:test
+
+      - name: Audit theme color governance
+        run: pnpm run theme:color-audit:all
+
+      - name: Validate theme visual governance contract
+        run: pnpm run theme:visual-contract
+
       - name: Lint web UI
         run: pnpm run lint:web
 
+      - name: Run web UI tests
+        run: pnpm --dir src/web-ui run test:run
+
       - name: Build web UI
         run: pnpm run build:web
 
+      - name: Type-check mobile web
+        run: pnpm --dir src/mobile-web run type-check
+
+      - name: Build mobile web
+        run: pnpm run build:mobile-web
+
       - name: Upload frontend build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: frontend-dist
           path: dist