No CI on PRs/pushes — check only runs at release tag

[mikedegeofroy]

Severity: High · Area: CI / release · Found in framework audit 2026-07-07

.github/workflows/ci.yml triggers only on tags: v*.*.* + workflow_dispatch. There is no CI on PRs or branch pushes → untested code merges to main, and the checkConfigDocs drift gate only fires at release time.

Fix: add pull_request + push: branches: [main] triggers so check (compile + tests + checkConfigDocs + frontend vitest) gates merges.