ci: add astro check + build smoke as PR gate

Repo had a deploy.yml on push to main but no PR-time CI. With
dependabot now opening grouped weekly bumps, every PR needs a real
gate. The new ci.yml runs npm ci + astro check (TS + content
collections) + npm run build on every PR and push.

Catches:

- Astro major-version build regressions (the deferred 5->6 PR is
  the test case).
- TS errors introduced by @types/* bumps.
- Tailwind config drift on @tailwindcss/vite bumps.
- Anything that npm install can resolve but astro build can't.

Author: Exploitacious

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: CI — Lint, Typecheck, Build
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  build-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Astro check (TypeScript + content collections)
+        run: npx astro check
+
+      - name: Build (smoke)
+        run: npm run build