ci: add PR/push verification workflow and harden release

- Add .github/workflows/ci.yml running `npm run verify` (lint, tests,
  audits, builds) on every push to main and pull request, so regressions
  can't reach main or a release tag unchecked.
- release.yml: use `npm ci` instead of `npm install` for reproducible builds.
- package.json: add `test` script aliasing the verify suite.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

package.json

@@ -8,6 +8,7 @@
     "build:extension": "node scripts/build-extension.cjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
+    "test": "node scripts/verify-release.mjs",
     "verify": "node scripts/verify-release.mjs"
   },
   "devDependencies": {