ci: add Phase 1 CI workflow

[jcameronjeff]

Phase 1 CI for token-5-0 — adds .github/workflows/ci.yml (additive new file). Part of the org-wide CI/CD formalization; deploys unchanged.

Prerequisites

• package-lock.json is committed (present, lockfileVersion 3) — required for npm ci

Cautions

• No test script exists in package.json, so no test step is run. No lint script either; typecheck (tsc --noEmit) is the only static gate.
• zod is imported in src/server.ts but is NOT a declared dependency in package.json — it currently resolves only transitively via @modelcontextprotocol/sdk (zod 4.3.6 in the lockfile). The build passes today, but a future SDK version that drops or hoists zod differently could break the build. Recommend adding zod to dependencies explicitly.
• The smoke-boot uses a fixed 3s sleep to let the stdio transport connect; on a very slow runner a real crash could theoretically happen after the check. The kill -0 liveness check plus the vault-DB-created assertion mitigate this.
• better-sqlite3 is rebuilt from source on every run (no prebuilt cache key beyond npm's). ubuntu-latest ships the needed build toolchain (python3, make, g++), so no extra setup is required.

Generated with Claude Code

https://claude.ai/code/session_01XD3eqvjHj4QckgL2iuj47u

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1260ca1cd4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep stdin open for the smoke-booted server

In this non-interactive bash run step, starting node dist/server.js & without any stdin redirection gives the background process /dev/null as stdin. Because this server uses StdioServerTransport, it observes EOF immediately after boot and exits before the sleep 3, so kill -0 reports a crash and every CI run fails even when the server started correctly. Redirect from a pipe/FIFO or otherwise keep stdin open while performing the liveness check.

Useful? React with 👍 / 👎.