Add CI workflow so the test suite actually gates changes

[genesis-dev-bot]

Closes #37.

Problem

Genesis had no CI. The test suite ran only when a human remembered to run
uv run --frozen pytest locally, which made every guard in it advisory rather than
enforced — including test_genesis_own_claude_workflows_meet_orchestrator_floor from
#36, whose entire purpose is to fail a change that lowers a turn budget. Three recent
commits merged on the strength of a hand-run result.

What's here

.github/workflows/ci.yml — push to main + pull_request, contents: read,
no secrets, uv run --frozen pytest tests/ -q, then git diff --exit-code uv.lock.

--frozen is load-bearing, not stylistic: a bare uv run re-resolves and rewrites
uv.lock, which is how a proxy registry's source URLs landed in f328364 and had to
be reverted in 06ad4c4. The lockfile step catches a regression if someone drops the
flag later.

tests/conftest.py — sets GIT_AUTHOR_*/GIT_COMMITTER_*.

This one wasn't in the issue and is the reason CI wouldn't have been green without it.
scaffold_new_repo ends in a real git commit, which aborts with exit 128 —
"Author identity unknown" — on a machine with no global git config. A fresh GitHub
Actions runner has none, so 19 of the 124 tests failed the first time I ran the
suite on a clean checkout, while passing on every developer machine. The suite was
silently depending on ambient host state. Env vars override config, so this holds
anywhere. Verified by reproducing the failure first, then the fix.

One new test asserting ci.yml stays pull_request-triggered, --frozen, and
free of ${{ secrets. }} — a CI job that costs money or an API key is one someone
eventually disables.

CLAUDE.md — a short CI section recording those invariants, in the same style as
the turn-budget section.

Verification

125 passed locally, uv.lock unchanged. Since this is a same-repo branch, the
workflow runs on this PR and proves itself before merge — check the CI job below.

Notes

• A human must merge this. Genesis has no auto-merge workflow.
• On the auto-merge question the issue raised: deliberately out of scope, and now
  filed separately. Auto-merge only makes sense once there's a real gate to auto-merge
  behind, which is what this PR adds — so it was a prerequisite, not a companion.
• Not fixed here (separate signal, worth its own issue if it recurs): a real user
  running genesis new on a machine with no git identity hits the same exit-128 crash
  with no useful error. The fix above is test-scoped on purpose.

🤖 Generated with Claude Code