[Jared][ci] M13 — CI baseline: pnpm workspace + GitHub Actions (closes #13)

[ninan-versioning]

Closes #13.

What this PR does

Wires the CI/CD baseline for the v0.1 Varitea release train (issue #14). Right now main has zero CI — statusCheckRollup is empty across all 7 open PRs. We're flying blind on regression. This PR fixes that before the merge train starts.

What lands

• package.json — workspace root. packageManager: pnpm@9.12.0, Node >=20. Root scripts use pnpm -r --if-present so packages without a given script (e.g. no test yet) don't break CI.

• pnpm-workspace.yaml — workspace root declaring connectors/*, packages/*, apps/*. This supersedes the workspace file each open PR currently adds.

• .nvmrc — 20.

• .github/workflows/ci.yml — runs on PRs to main and pushes to main:

  1. Checkout
  2. pnpm 9.12.0 + Node 20 (cached)
  3. pnpm install --frozen-lockfile=false (first install — no root lockfile yet)
  4. pnpm -r --if-present run typecheck
  5. pnpm -r --if-present run test

• .github/CODEOWNERS — workflow + workspace root changes require maintainer review. Stops future PRs from silently disabling CI.

Why --if-present

main is currently prose-only (AGENTS.md, agent.md, design.md, soul.md). There are no packages to typecheck or test until #15 lands. --if-present lets this PR merge clean and turn green, then real per-package scripts get exercised as each connector PR lands.

Heads-up to every open PR

6 of 7 open PRs add a root pnpm-workspace.yaml (#15, #16, #18, #19, #21, #22). Once this PR merges, those 6 will go CLEAN → CONFLICTING on that one file. The resolution is trivial — delete the PR's pnpm-workspace.yaml and accept the root one (which already includes connectors/*).

Recommended rebase order after this PR merges:

1. feat(connectors/shopify): first-class Shopify→USD primitives + MCP/HTTP-SSE + Temporal #15 shopify-connector-mcp — clean otherwise, foundational
2. feat(connectors/google-ads): first-class Google Ads primitives + MCP/HTTP-SSE + Temporal #18 google-ads-connector — clean otherwise, isolated
3. feat(twin-renderer): Three.js USD product twin renderer + Varitea demo #16 twin-renderer — already CONFLICTING, needs rebase regardless
4. feat(varitea-landing): motion-led landing + business-email-only conversion #17 varitea-landing — touches no root files, should stay clean
5. feat(connectors/distribution): Postiz organic + Meta/TikTok DRAFT + Klaviyo Flows #22 distribution-adapters — was CLEAN, will need 1-line rebase
6. feat(bandit): Thompson Sampling consumer closing the brand_rules feedback loop #21 bandit-consumer — already CONFLICTING
7. feat(animated-shorts): Three.js + Remotion shorts pipeline w/ local & router render modes #19 animated-shorts — already CONFLICTING, also depends on feat(twin-renderer): Three.js USD product twin renderer + Varitea demo #16

After this merges

Set branch protection on main requiring the Typecheck + Test (Node 20, pnpm) check (commands in the chat that opened this PR — not auto-applied; needs admin).

Not in scope (intentionally)

• Lint — no eslint / biome config exists in any open PR yet. Not faking one.
• Preview deploys — issue M13: CI/CD baseline — lint + test + preview deploys #13 mentions them; deferred to a follow-up PR once Vercel/Cloudflare targets are decided per app.
• Coverage gates — premature; revisit at v0.2.

Test plan

• CI passes on this PR itself (no packages → both steps skip cleanly via --if-present).
• Sanity check after feat(connectors/shopify): first-class Shopify→USD primitives + MCP/HTTP-SSE + Temporal #15 rebases on top: the workflow exercises connectors/shopify/{typecheck,test} against the real Vitest suite.