ci: local npm run gate == CI gate + stale-green guard

[mastermanas805]

What

Hardens the instanode-web CI gate so the failure modes hit this session cannot recur.

1. npm run gate — local gate == CI gate

New gate script in package.json:

tsc --noEmit && npm run build && vitest run

npm run build already chains tsc && vite build && node scripts/prerender.mjs — the exact sequence CI's build-and-test job runs. Fix agents previously ran vite build alone, which skips scripts/prerender.mjs; a crashing prerender step shipped a broken main even though the local build passed. npm run gate is one command that cannot pass while CI fails.

2. Stale-green guard

New up-to-date-with-base job in ci.yml. A PR can show a green run executed before a breaking commit landed on main — merging it would ship a broken base. This job runs git merge-base --is-ancestor origin/<base> HEAD and fails the PR if the branch is behind, forcing an "Update branch" before merge.

Verification

npm run gate runs clean locally: tsc + full build (incl. prerender) + 662 vitest tests pass.

Scope

Touches only package.json and .github/workflows/ci.yml — disjoint from any source changes.

🤖 Generated with Claude Code

[mastermanas805]

Rebase attempt 2026-05-20 hit conflicts. main already has .github/workflows/ci.yml. Same review-vs-supersede call as #102.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

[mastermanas805]

Status check 2026-05-20 — still adds value

Audit against current main (61a89cd):

• package.json — main has no gate script. This PR adds gate: tsc --noEmit && npm run build && vitest run. Required by CLAUDE.md rule 23.
• .github/workflows/ci.yml — main has no up-to-date-with-base job. This PR adds it.

Not replaced by INTEGRATION-TESTS-2026-05-20.md — that work targets api/worker/provisioner Go integration tests (backup/restore, Brevo webhook, propagation runner, deep /readyz). It does not touch instanode-web.

Verified live: ran npm run gate on this branch in a fresh worktree against current main — 38 test files / 662 tests pass; tsc clean; full build (incl. scripts/prerender.mjs) OK.

Mergeability: MERGEABLE / CLEAN. CI green (up-to-date-with-base, build-and-test, playwright all SUCCESS as of 2026-05-20 17:01 UTC).

Recommendation: merge. PR holds up against current main; the value (local gate == CI gate + stale-green guard) is not duplicated by any other 2026-05-20 work.