[codex] Add pull request CI

[echowang1]

Summary

• Add a GitHub Actions CI workflow for PRs and main pushes.
• Run npm ci, typecheck, tests, and build.
• Update package-lock so clean installs are reproducible.
• Document that PRs run the same verification steps and update Phase 9 tasks.

Validation

• npm ci
• npm run typecheck
• npm test
• npm run build
• YAML parse check for .github/workflows/ci.yml
• git diff --check

Note

• npm audit remains in the release checklist, but is not part of PR CI because the registry audit endpoint is flaky in this environment.