ci: adopt detect-changes gating, runloopai actions, pnpm 10 workspace security pins, drop ink-big-text

[jason-rl]

Description

Adapts the CI consolidation and supply-chain hardening patterns from runloopai/runloop-fe#1919 into rl-cli, and removes the ink-big-text runtime dependency.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• Test updates

Related Issues

Closes #

Changes Made

ci.yml — adopt runloop-fe#1919 patterns

• detect-changes job: gates format/lint/build/test via tj-actions/changed-files (SHA-pinned) + inlined ci.yml self-change detection. Self-change detection now enumerates job keys via yq rather than a hardcoded list, so new jobs are automatically detected.
• runloopai/* action wrappers: runloopai/checkout@main, runloopai/pnpm-action@master, runloopai/setup-node@main, runloopai/github-script@main, runloopai/upload-artifact@main throughout. Third-party tj-actions/changed-files remains SHA-pinned.
• Push trigger on main with push-aware concurrency (run_id key for push — never cancels main builds; ref key for PRs — cancels superseded runs).
• Conditional runs-on: when a job will do real work it gets ubuntu-latest; when skipped it stays on ubuntu-slim. Job-level if: with failure() || (success() && (pull_request || output != 'false')) ensures required status checks always report even when skipped.
• No job-level name: fields: GitHub uses the job ID as the status-check context when name: is absent. Omitting them preserves the lowercase-hyphen job-ID contexts the branch ruleset requires (detect-changes, format, lint, build, test).
• Removes the old ready-to-merge aggregator and the old inlined dependency-check job.

dependency-age-check.yml — separated supply-chain gate

Moves the dependency age gate out of ci.yml into its own workflow using runloopai/lisan-al-gaib-action@main (already in place). Adds a push trigger with path filters so the gate re-runs on main merges that touch the lockfile or workspace configuration.

release.yml — App token for release-please (unchanged from prior commit)

• actions/create-github-app-token@v3 mints a short-lived token for release-please so its PRs fire a normal pull_request event, eliminating the need for pull_request_target.

pnpm 10 + pnpm-workspace.yaml — security pins

• Bumps packageManager to pnpm@10.33.0 and removes the "pnpm" field from package.json (pnpm 10 reads these settings from pnpm-workspace.yaml instead).
• New pnpm-workspace.yaml: minimumReleaseAge: 10080 (7-day supply-chain gate matching lisan-al-gaib's min-age-days), @runloop/api-client excluded from the age gate, onlyBuiltDependencies: [esbuild].
• 23 advisory-keyed security overrides: each key is the Dependabot advisory's vulnerable_version_range, value is the exact first_patched_version (no carets). Replaces the old scoped/caret-based overrides in package.json#pnpm.

ink-big-text removal

• src/components/Banner.tsx: replaces the runtime cfonts/ink-big-text render with a pre-rendered BANNER_ART template literal, removing the cfonts/window-size transitive dependency subtree.
• Cleans up jest.mock("ink-big-text", …) from all three test setup files and removes ink-big-text from jest.config.js transformIgnorePatterns.

Lockfile hygiene

• .gitattributes: pnpm-lock.yaml -merge linguist-vendored (prevents garbage merge conflicts; drops lockfile from GitHub language stats).
• .prettierignore: adds pnpm-lock.yaml.

Testing

• pnpm run build (tsc) → clean
• pnpm run lint → 0 errors (pre-existing warnings only)
• pnpm run format:check → passes
• pnpm run test:components → 34 suites, 296 tests pass
• actionlint .github/workflows/ci.yml .github/workflows/dependency-age-check.yml → clean
• yq -r '.jobs | keys | .[]' and yq -r '.jobs["detect-changes"].outputs | keys | .[]' on ci.yml return expected keys

End-to-end caveat: the detect-changes/yq/self-change logic and the dependency-check/minimumReleaseAge age gates only fully exercise in GitHub Actions and depend on yq being present on ubuntu-slim. First CI run on this PR is the real validation.

Manual prerequisites before merging:

1. Create a GitHub App with contents: write + pull-requests: write, install it on this repo, and add repo secrets DEPLOY_APP_CLIENT_ID and DEPLOY_APP_PRIVATE_KEY. Also ensure Settings → Actions → "Allow GitHub Actions to create and approve pull requests" is enabled.
2. Update the "main" branch ruleset required-status-check contexts atomically with this merge: remove ready-to-merge and add detect-changes so the full required set is: detect-changes, format, lint, build, test, dependency-check, pr-title-check. If detect-changes is omitted, a runner outage silently skips all downstream jobs and unblocks merge.

Checklist

• My code follows the code style of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have updated the documentation accordingly
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published