hir-130: add GitHub Actions CI (typecheck + lint + test:int)

[jaredzwick]

Summary

Adds .github/workflows/ci.yml so PRs to pypesdev/coldflow actually get tested before merge. Today the open HIR-94 PRs all show "no checks reported" — pnpm test:int only runs on the engineer's local machine.

The workflow runs on every pull_request and every push to main:

• pnpm install --frozen-lockfile
• pnpm exec tsc --noEmit — there is no typecheck script in package.json yet, so the issue's tsc --noEmit fallback is used directly
• pnpm lint
• pnpm test:int

test:int boots Payload, which refuses to start without PAYLOAD_SECRET and a Postgres connection. CI provisions a postgres:16-alpine service container (matches docker-compose.yaml), creates the payload database, and exports DATABASE_URL_PAYLOAD + a test-only PAYLOAD_SECRET. Node and pnpm versions match the Dockerfile: Node 22.17.0, pnpm 10 (no packageManager field is pinned in package.json, so the workflow pins explicitly).

README has a new # CI section documenting the four commands so contributors know what to expect locally.

Once merged, all open HIR-94 PRs will start getting checks after a rebase. Per HIR-130: Vercel preview-deploy auth, E2E tests, and coverage gates are out of scope.

Test plan

• pnpm install --frozen-lockfile succeeds locally with pnpm 10.23.0
• pnpm exec tsc --noEmit passes on origin/main
• pnpm lint passes (warnings only) on origin/main
• 7/8 test:int files pass without env; the 8th (api.int.spec.ts) needs Payload + Postgres, which CI now provides
• CI green on this PR after open
• After merge, rebase one open HIR-94 PR and confirm CI runs

🤖 Generated with Claude Code

[jaredzwick]

First-run gate: GitHub treats this as the repo's first workflow file from a fork PR, so the run won't kick off until a pypesdev/coldflow maintainer clicks Approve and run on the Actions tab. After that the four steps run automatically on every subsequent PR.

To validate after merge, rebase one of the open HIR-94 PRs (#8, #13, #18, #19, #20, #21, #22) and confirm a green check appears.