CI has no build/test workflow — main broke silently under dependabot auto-merge

[forkwright]

Finding

akroasis CI runs Security (cargo-audit/cargo-deny), gate-attestation, commit hygiene, and auto-merge — but no job ever compiles or tests the workspace. Main does not currently build, and nothing noticed.

Evidence

• cargo check --workspace on main @ b75b5ac (2026-07-16): 12+ E0599 errors — snafu::Location::new(file!(), line!(), column!()) across kerykeion (collector, handshake, tcp/serial transports, topology, store_forward, error, types, crypto). snafu 0.9 changed Location to &'static std::panic::Location (no new); the 0.8→0.9 bump entered the lockfile via a dependabot PR that auto-merged on green Security checks.
• .github/workflows/: security.yml, gate-attestation.yml, dependabot-auto-merge.yml, release*, stale — no check/clippy/test workflow (compare epistole: Check/Clippy/Format/Test + kanon-lint on every PR).
• The breakage only surfaced when a local kanon gate ran for fix(deps): clear RUSTSEC-2026-0190/-0204 + yanked crates via lockfile bumps #260 (the gate compiles; CI does not).

Why this matters

Dependabot auto-merge validated by CI that never compiles = automated rot: any semver-major API change merges silently, and every downstream consumer inherits a broken main. The gate-attestation requirement can't compensate — bots are waived from it by design.

Desired correction

Add a CI workflow compiling + testing the workspace on PRs and main (epistole's Check/Clippy/Format/Test + kanon-lint layout is the fleet-proven shape), and make dependabot auto-merge require it. The immediate snafu-0.9 migration (snafu::location!()) ships with #260.

Done when: a PR that fails cargo check --workspace cannot auto-merge, and main compiles in CI on every push.

[forkwright]

Re-verified on main @ 8506c10 (2026-07-16, post-#260 + several more dependabot merges): the snafu-0.9 Location::new() break this issue originally cited is fixed — no snafu errors remain.

However, cargo check --workspace --all-features still fails on main with a different pre-existing compile error (unrelated to any dependency bump): two incompatible RadioIdent types in syntonia::baofeng::{ident,variant} plus a non-exhaustive-match error in crates/akroasis/src/radio/serial_hardware.rs. Filed separately as akroasis#265 (root cause + fix path) since it's a distinct object-level defect from this issue's CI-gate-missing finding. This is further confirmation of this issue's core claim: main has been able to silently stop compiling because no CI job ever runs cargo check/cargo build/cargo test against the workspace.

Also note: reproducing this locally required installing libudev-dev and protobuf-compiler system packages that weren't present in the build environment used to check this — worth confirming whatever CI workflow eventually gets added (per this issue's Desired correction) installs these, or the new workflow will red on missing system deps rather than the actual code issue.