chore(ci): add GitHub Actions workflow running check + assembleDebug

[ilmoniemi]

User Story

As a Pyrycode mobile developer (human + agent), I want every PR and every push to main to run ./gradlew check assembleDebug on GitHub Actions, so that the deterministic style / lint / build / test gates are enforced by CI rather than relying on the developer agent's self-run.

Context

The developer agent currently self-runs ./gradlew test && lint && assembleDebug before opening a PR, and code-review verifies. Both are stochastic. CI is the deterministic safety net that closes the gap.

Spotless (#83) and Compose Lint Checks (#84) have both landed, so the umbrella ./gradlew check task already exercises formatting, lint (with abortOnError), and unit tests. This ticket wires the CI workflow on top.

Acceptance Criteria

• .github/workflows/ci.yml triggers on pull_request and push to main (use pull_request, NOT pull_request_target — the latter exposes secrets to fork PRs)
• Workflow checks out the repo, sets up JDK matching AGP's requirement (JDK 17 unless AGP version requires otherwise — confirm during implementation), caches Gradle, runs ./gradlew check assembleDebug
• Uses actions/setup-java@v4 and gradle/actions/setup-gradle@v3 (or current stable — verify via context7 / repo READMEs)
• Gradle Wrapper validation step included (e.g. gradle/wrapper-validation-action or the equivalent in setup-gradle)
• First CI run on the PR introducing this workflow is green

Technical Notes

• Standard Gradle caching pattern via setup-gradle@v3 (handles ~/.gradle/caches automatically)
• DO NOT add a branch protection rule in this ticket — informal "wait for green CI" is fine; protection rules are a follow-up

Size Estimate

XS — single new file (~30–50 lines of YAML), no Kotlin/Gradle changes.

Figma

N/A — tooling/infra ticket.

Split from #72.

[ilmoniemi]

🤖 Product Owner — creates structured issues

po agent has completed work on this ticket.

Agent output (click to expand)

Refined #85. Two small changes:

1. **Context updated** — siblings #83/#84 have already closed, so the "must land first" framing is now stale. New text states they've landed and `./gradlew check` already exercises both gates.
2. **AC #1 hardened** — added an explicit "use `pull_request`, NOT `pull_request_target`" note. The original AC said `pull_request` but didn't call out the security distinction; `pull_request_target` would expose repo secrets to fork PRs and is a common CI footgun worth pinning.

Size stays XS (already labelled). Not flagging `security-sensitive` — this is a CI workflow with no secrets, no auth surface, no untrusted-input parsing in production code; the `pull_request_target` warning is a workflow-config nit, not application security.

Ready for human review. Move to the next column when approved.

[ilmoniemi]

🤖 System Architect — defines Go interfaces, data flows, concurrency patterns

architect agent has completed work on this ticket.

Agent output (click to expand)

Spec committed.

**Sized XS**, no file overlap on `.github/workflows/ci.yml`. The spec specifies a single `.github/workflows/ci.yml` with `pull_request` + `push: main` triggers, concurrency cancellation on PR refs, `contents: read` permissions, and a single `ubuntu-latest` job running `checkout@v4 → wrapper-validation@v4 → setup-java@v4 (JDK 17 temurin) → setup-gradle@v4 → ./gradlew check assembleDebug`. Open questions flag the JDK 17 vs 21 verification (AGP 9.2.1) and `setup-gradle@v3 → @v4` bump for the developer to confirm at implementation time. Spotless's `**/*.yml` target is called out so the YAML doesn't trip `./gradlew check` locally.

Ready for human review. Move to the next column when approved.