ci: document the full validation gate for contributors

[7shep]

Summary

The full validation gate is already checked in at .github/workflows/ci.yml and running on every pull request and push to main, but CONTRIBUTING.md never mentioned it — the one acceptance criterion from #55 that was still outstanding.

• New Continuous integration section under Testing and Validation: what triggers a run, the Node/pnpm versions and frozen-lockfile install, the read-only permission scope, run cancellation, the three jobs and where each one runs, which two are required for merge, and how to get the failure diagnostics artifact.
• Notes that a change to what a root script covers must update the workflow in the same PR, so the local and CI gates cannot drift.
• Validate locally now points at that section.
• CI status badge added to the README.

No workflow behaviour is changed; this documents what is already there.

Existing workflow, verified against the issue

Criterion	Where
PRs targeting main and pushes to main	on.pull_request / on.push.branches
Declared Node and pnpm versions	NODE_VERSION: 22, PNPM_VERSION: 11.7.0, matching root engines and packageManager
Frozen lockfile install	pnpm install --frozen-lockfile
lint, typecheck, build, format:check, test	Quality gate job
Supported caching	actions/setup-node with cache: pnpm, plus a Turbo cache
Least privilege	permissions: contents: read
Cancel superseded runs	concurrency keyed on PR number or ref, cancel-in-progress: true
No secrets or model credentials	none referenced
Successful run demonstrated	e.g. the green Quality gate, Trusted runtime and security, and three Local runtime checks on #87, and the checks on this PR

The actions are pinned by commit SHA, and the gate is wider than the issue asked for: it also runs the trusted-runtime security suite and a Windows/macOS/Linux local-runtime matrix.

Coordination with #45

#87 changes what format:check enumerates. It does not change the script name, so the workflow needs no edit; the new section states the rule that keeps that true in future.

Validation

• pnpm format:check

Closes #55.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
universal	Ready	Preview	Jul 31, 2026 6:45pm