Add canonical source gate and CI

[szweibel]

Adds one credential-free backend/frontend verification contract and runs it in GitHub Actions.

• 527 backend tests
• frontend lint, TypeScript, and production build
• locked uv and Bun installs
• provider credentials blanked or replaced with local test-only values
• immutable action pins and read-only permissions
• no NML, Docker, routing, or deployment mutation

Local canonical gate and actionlint passed.