CI: wire the gate suite into GitHub Actions

[lann]

No CI exists; every gate is a runnable command. Wire them into GitHub Actions:

• cargo build --workspace + cargo test -p translator-shim -p bindgen -p testgen
• cd runtime && deno task check && deno task test
• cd harness && deno task conformance (Deno lane, full 1395-command corpus)
• seeded-scheduler runs (DELTIC_SCHED_SEED=1 / =4242) over the task/async/stream suites
• wasi-shims, ct-runner, ports/{websocket,webcrypto,webrtc} test suites
• browser lanes: deno run -A tools/browser/run-lane.ts chromium first; Firefox (JSPI pref set by the driver) next; WebKit best-effort — needs playwright browsers + the Ubuntu-24.04 dependency staging recipe in harness/browser/expectations/webkit.ts
• consumer suites as release gates (docs/consumers.md, "their suites become our gates"): websocket conformance 55/55 spawns their real echod (builds from the polymorph checkout — needs a vendoring/fetch strategy in CI); the iroh endpoint exam needs an iroh-relay binary — decide hosted-vs-skipped per lane

ARM64 note: current development is linux-arm64; GH-hosted runners are x64 by default — the WebKit dep recipe and any prebuilt-binary assumptions (node-datachannel) need re-verification on the CI architecture.

[lann]

In flight this turn: core lane wiring (cargo suites, all deno package suites, Deno-lane conformance, seeded runs, ports unit suites, Chromium + Firefox browser lanes, WebKit best-effort) plus a release workflow (gh prerelease artifacts, tag = pre-<main short hash> — see #16). Remaining scope for this issue after that lands: the consumer-suite gates (websocket 55/55 vs their echod, the iroh endpoint exam vs iroh-relay) — needs the vendoring/fetch strategy this body describes, since CI has no polymorph checkouts.

[lann]

Scope update (post PR #26): the core + browser + release lanes are in and have a track record; what remains here is only the consumer-artifact gates, all blocked on the same vendoring/fetch decision (CI has no polymorph checkouts):

• websocket conformance 55/55 (needs their echod built from the consumer tree)
• iroh endpoint exam (needs the iroh-relay binary; currently built in the consumer tree's .deps/iroh)
• new: tools/smoke-tls/run.ts --exec (needs the prebuilt target/conformance/*.wasm suite compositions from polymorph-tls; now in the AGENTS.md gate list)

A plausible shape: a pinned-artifact bundle (the suite .wasm files + echod/iroh-relay binaries per arch) published as a release asset or fetched from the polymorph repos at pinned revs — which overlaps with the #14 upstreaming and #16 versioned-release decisions.

[lann]

Closing as done: the core/browser/release lanes are the CI gate suite. The consumer-artifact gates (websocket echod, iroh exam, tls smoke exec) stay dev-box gates per AGENTS.md — none of these projects is stable enough for cross-repo pinning to be worth blocking on now. Revisit alongside #14/#16 when the repos stabilize.