ci: add PR/push verification workflow and harden release

- Add .github/workflows/ci.yml running `npm run verify` (lint, tests,
  audits, builds) on every push to main and pull request, so regressions
  can't reach main or a release tag unchecked.
- release.yml: use `npm ci` instead of `npm install` for reproducible builds.
- package.json: add `test` script aliasing the verify suite.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -132,7 +132,7 @@ jobs:
 
       - name: Build Extensions
         run: |
-          npm install
+          npm ci
           npm run build:extension
 
       - name: Generate artifact attestation for extensions