add github actions test workflow + branch protection prep (PR-3 fast loop)

[HumanBean17]

Summary

Implements PR-3 from plans/PLAN-TEST-SUITE-FAST-LOOP.md (per propose/TEST-SUITE-FAST-LOOP-PROPOSE.md §3 C / §8 PR-3).

• .github/workflows/test.yml (new) — single Ubuntu / Python 3.11 job; pip install -r requirements.txt then pip install -e . (so the java-codebase-rag CLI entry point is registered for tests/test_java_codebase_rag_cli.py); runs pytest tests -v with JAVA_CODEBASE_RAG_RUN_HEAVY=0. Workflow name: test and job name: test are both explicit so the check-context string GitHub renders is deterministic.
• tests/README.md — tighten the Merge gate (mechanical) paragraph: point at the now-real .github/workflows/test.yml, document the required check on master, and record enforce_admins: false as the break-glass policy. Tier tables, consumer matrix, and the iteration-subset paragraph are untouched (PR-1 / PR-2 own those).

Actual check-context string

gh pr checks 102 on the first run reports the context as test (single token — GitHub collapses when workflow name equals job name). The README and the branch-protection recipe below were updated to that verbatim string in the second commit on this PR (Risk #7 in the plan).

Landing-order divergence (called out per plan)

The plan specifies PR-3 → PR-1 → PR-2, but PR-1 (#100) and PR-2 (#101) already merged. PR-3 is therefore shipping last. The risk this opened (a small window where PR-1's fixture refactor was not mechanically validated by CI) is closed by this PR going green here.

Scope sentinels (per plan §3 / agent-workflow per-PR contract)

git diff master..HEAD --stat:

.github/workflows/test.yml |  26 ++++++++++++++++++++++++++
tests/README.md            |   2 +-
2 files changed, 27 insertions(+), 1 deletion(-)

Out of scope (verified zero hits in diff): tests/conftest.py, tests/_builders.py, any tests/test_*.py, .cursor/skills/, production code under build_ast_graph.py / server.py / kuzu_queries.py / etc.

Manual evidence

• .venv/bin/ruff check . → All checks passed!
• JAVA_CODEBASE_RAG_RUN_HEAVY=0 .venv/bin/python -m pytest tests -q → 372 passed, 7 skipped, 2 warnings in 308.90s (0:05:08) (exit 0). The 7 skips are the JAVA_CODEBASE_RAG_RUN_HEAVY-gated and cocoindex-conditional cases documented in tests/README.md.

Post-open procedural steps (the maintainer runs these; do NOT skip)

Per plan §3 (Tests for PR-3) + Risk #2 + Risk #7. None of these touch git history beyond an optional throwaway branch:

1. Confirm the check-context string stays test on the next workflow run (sanity):

   gh pr checks 102

   If it ever differs, re-edit the tests/README.md paragraph in this PR before merge so the doc matches the value GitHub will require.

2. Dummy-failure validation (Risk Tier 1 completion plan + proposals (B2a + B4 + B5) #2 — false-green workflow). On a throwaway branch:

   git checkout -b throwaway/pr-3-dummy-failure
   printf 'def test_pr3_dummy_failure():\n    assert False\n' > tests/test_pr3_dummy.py
   git add tests/test_pr3_dummy.py && git commit -m "tmp: prove workflow goes red"
   git push -u origin throwaway/pr-3-dummy-failure
   # open a PR, confirm the `test` check goes red and merge is blocked, then close + delete the branch

3. Apply branch protection with the verbatim check-context string (Risk Implement PR-A2: SpEL/constant-ref routes and route MCP tools #7):

   gh api -X PUT /repos/HumanBean17/java-codebase-rag/branches/master/protection --input - <<'JSON'
   {
     "required_status_checks": {"strict": false, "contexts": ["test"]},
     "enforce_admins": false,
     "required_pull_request_reviews": null,
     "restrictions": null,
     "allow_force_pushes": false,
     "allow_deletions": false
   }
   JSON

Definition of done (mirrors plan)

• .github/workflows/test.yml exists
• tests/README.md merge-gate paragraph updated; no other section touched
• Check-context string verified verbatim from gh pr checks (test) and reflected in doc + recipe
• ruff clean; local pytest tests green
• Workflow runs green on this PR (CI-side — confirm before merge)
• Dummy-failure validation completed and reverted (procedural — step 2 above)
• Branch protection applied with contexts: ["test"] (procedural — step 3 above)
• PR body notes the PR-1 / PR-2 / PR-3 landing-order divergence