ci: add Phase 1 CI workflow

[jcameronjeff]

Phase 1 CI for uat — adds .github/workflows/ci.yml (additive new file). Part of the org-wide CI/CD formalization; deploys unchanged.

Prerequisites

• opzero-sh/.github must expose .github/workflows/ci-bun.yml on main with inputs working-directory, bun-version, run-typecheck, run-lint, run-test, run-build (per the org reusable-workflow contract).
• ci-bun.yml must run bun install --frozen-lockfile so the committed bun.lock is the source of truth (typecheck needs deps installed because tsconfig pulls in bun-types).

Cautions

• Two lockfiles are committed (bun.lock + pnpm-lock.yaml). CI uses bun.lock; the pnpm-lock.yaml is unused for CI and is a drift hazard — consider removing it to avoid confusion (not required for CI to pass).
• Hint said the suite has 30+ tests; the actual count is 28 test() cases in mcp-server/src/tools/tests/scenario.test.ts. The suite still runs green; just a count discrepancy.
• package.json dev/start scripts are broken (point at src/index.ts instead of mcp-server/src/index.ts). CI never runs them, but they will mislead local devs.
• tsconfig include is mcp-server/src/**/*.ts only, so src/visual-diff.ts is NOT typechecked by tsc --noEmit. CI reflects the repo's current typecheck scope; widening it is a separate decision.

Generated with Claude Code

https://claude.ai/code/session_01XD3eqvjHj4QckgL2iuj47u