CI quality gates

For maintainers. Using T3 Code? See docs/user.

.github/workflows/ci.yml runs these quality gates on pull requests and pushes to main:

• Check: vp check (format and lint; this repo sets typeCheck: false in its lint options), then vpr typecheck for the workspace type check. The same job builds the desktop pipeline (vp run build:desktop) and verifies the preload bundle exists and still exports its expected symbols.
• Test: vp run test across the workspace.
• Mobile Native Static Analysis: vp run lint:mobile on macOS, wrapping scripts/mobile-native-static-check.ts. A cheap Linux Mobile Native Changes job gates it: the macOS runner only boots when the diff touches apps/mobile Swift/Kotlin sources, the SwiftLint/detekt/ktlint configuration, the Brewfile, the check script, the root package.json that defines lint:mobile, or ci.yml. Otherwise the job is skipped, which GitHub reports as success for the required check. Renames are matched on both their old and new path. The gate fails open in every other case: if the changed-file list cannot be resolved, GitHub truncates it, or the gate job itself fails, the lint runs.
• Release Smoke: exercises release-only workflow steps through scripts/release-smoke.ts, so release breakage surfaces on PRs rather than at tag time.

.github/workflows/release.yml builds macOS (arm64 and x64), Linux (x64), and Windows (x64) desktop artifacts from a single v*.*.* tag and publishes one GitHub release. It auto-enables signing only when platform credentials are present. macOS passkey builds additionally require APPLE_TEAM_ID and the MACOS_PROVISIONING_PROFILE secret; Windows uses Azure Trusted Signing. Without the core signing credentials, it still releases unsigned artifacts.

See Release Checklist for the full release/signing setup checklist.