ci: add CI workflow and gate npm publish on test suite

The repo had no CI; the only workflow (npm-publish.yml) published to npm
on GitHub release without running any tests, so a broken branch could
ship a release with provenance attached.

- ci.yml: two jobs on push/PR to main and next
  - test (required): typecheck, biome check, unit tests, bundle-size
    regression, build
  - performance (continue-on-error): timing regression, informational
    only since shared runners are too noisy for assertions
- npm-publish.yml: run bun run check (typecheck + biome check + tests +
  bundle regression) before Build package

Both jobs use frozen-lockfile installs so PRs can't silently change
dependencies. After merge, mark the test job as a required status check
in GitHub branch protection for main and next.

Author: estherbrunner

.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: CI
+
+on:
+    push:
+        branches: [main, next]
+    pull_request:
+        branches: [main, next]
+
+jobs:
+    test:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@v1
+              with:
+                  bun-version: latest
+
+            - name: Install dependencies
+              run: bun install --frozen-lockfile
+
+            - name: Typecheck
+              run: bunx tsc --noEmit
+
+            - name: Lint and format
+              run: bunx biome check .
+
+            - name: Unit tests
+              run: bun run test
+
+            - name: Bundle size regression
+              run: bun test test/regression-bundle.test.ts
+
+            - name: Build
+              run: bun run build
+
+    performance:
+        runs-on: ubuntu-latest
+        continue-on-error: true # informational only — shared runners are too noisy for timing assertions
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+
+            - name: Setup Bun
+              uses: oven-sh/setup-bun@v1
+              with:
+                  bun-version: latest
+
+            - name: Install dependencies
+              run: bun install --frozen-lockfile
+
+            - name: Performance regression (informational)
+              run: bun test test/regression-performance.test.ts

.github/workflows/npm-publish.yml

@@ -22,6 +22,9 @@ jobs:
             - name: Install all dependencies (including devDependencies for build)
               run: bun install
 
+            - name: Typecheck, lint, test, and bundle regression
+              run: bun run check
+
             - name: Build package
               run: bun run build