ci: add GitHub Actions CI workflow with mocha and eslint

[czirker]

Summary

• Adds CI workflow that runs on push to master and pull requests
• mocha tests run as a blocking step (working-directory: src)
• eslint runs as non-blocking advisory lint step
• Adds lint script to src/package.json

Task Reference

• Jira: https://chb.atlassian.net/browse/ES-2706
• Parent: https://chb.atlassian.net/browse/ES-2701

Changes Made

• Added .github/workflows/ci.yml
• Added lint script to src/package.json

Checklist

• mocha tests (blocking)
• eslint (non-blocking, continue-on-error: true)
• Uses actions/checkout@v4 and actions/setup-node@v4

Made with Cursor

---

Note

Low Risk
Low risk CI-only change; main concern is a duplicate lint script key in src/package.json, which could confuse tooling even though it resolves to the same command.

Overview
Adds a new GitHub Actions workflow (.github/workflows/ci.yml) that runs on pushes and pull requests to master, installs dependencies in src, runs npm run lint as a non-blocking step, and then runs npm test.

Updates src/package.json to include a lint script for ESLint (note: the diff introduces a duplicate lint script entry).

^{Written by Cursor Bugbot for commit 3a8561d. This will update automatically on new commits. Configure here.}

[ch-snyk-sa]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

Duplicate lint key in package.json scripts

Low Severity

The "lint" key appears twice in the scripts object of src/package.json. While JSON parsers typically accept this (using the last value), duplicate keys are technically not allowed by the JSON spec and indicate an accidental copy-paste. This is confusing for anyone reading the file and may cause warnings in strict JSON tooling.