ci: run the CLI suite

The repo moved to npm workspaces and CI followed the core package: there is a
job for typecheck, test, build, verify-dist and pack across three node
versions. Nothing runs the CLI's suite — roughly 2470 tests, including the 29
provider bridge suites that byte-compare against goldens captured before the
extraction. Issue #809 says every phase PR passes a byte-identical parity gate;
until now nothing enforced it.

Two things stood in the way. The CLI's test script was `vitest`, which is watch
mode — in CI that hangs a runner instead of failing. And the root test script
forwarded only to the CLI workspace, so core's guardrail suite never ran from
the command a contributor reaches for, while the CLI half of it could not run
from a clean checkout at all: core's exports resolve to dist, which is
gitignored.

The root script now builds core before running either suite. That costs a
build on every local run, which is a real annoyance, but the alternative is a
script that only works if you happen to have built core earlier.

The CLI job runs the suite on two node lines: the engines floor (22.13.x) and
24.x. The second leg is not matrix sprawl — the zed bridge parity suite seeds
its fixture with zlib's zstd, which only landed in 22.15, so a floor-only job
would silently skip the byte-compare gate this job exists to run and still go
green. The floor leg keeps the >=22.13 promise enforced; the 24.x leg makes
the parity gate actually execute. The job carries a 15-minute timeout —
measured wall time for the whole suite is ~2 minutes — so a hung run cannot
burn a runner for the default six hours, and the workspace-versions check runs
before npm ci: it only reads the three manifests and the lockfile, so a drift
fails in a second instead of after a full install.

.github/workflows/ci.yml

@@ -41,6 +41,33 @@ jobs:
       - name: Verify package contents
         run: npm pack --workspace=@codeburn/core --dry-run
 
+  cli:
+    name: cli (node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['22.13.x', '24.x']
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Check workspace versions
+        run: npm run check:workspace-versions
+
+      - name: Install from lockfile
+        run: npm ci
+
+      - name: Build core
+        run: npm run build --workspace=@codeburn/core
+
+      - name: Test cli
+        run: npm test --workspace=codeburn
+
   semgrep:
     runs-on: ubuntu-latest
     steps:

package.json

@@ -13,7 +13,7 @@
     "build:cli": "npm run build:cli -w codeburn",
     "build:dash": "npm run build:dash -w codeburn",
     "dev": "npm run dev -w codeburn",
-    "test": "npm run test -w codeburn",
+    "test": "npm run build -w @codeburn/core && npm run test -w @codeburn/core && npm run test -w codeburn",
     "check:workspace-versions": "node scripts/check-workspace-versions.mjs"
   },
   "engines": {

packages/cli/package.json

@@ -16,7 +16,7 @@
     "build:cli": "tsup && node -e \"const fs=require('fs'); fs.copyFileSync('src/cli.ts','dist/cli.js'); fs.chmodSync('dist/cli.js',0o755)\"",
     "build:dash": "cd ../../dash && npm install --no-audit --no-fund --silent && npm run build",
     "dev": "NODE_OPTIONS=--no-deprecation tsx src/cli.ts",
-    "test": "vitest",
+    "test": "vitest run",
     "prepublishOnly": "npm run build"
   },
   "keywords": [