CI quality gates

For maintainers. Using T3 Code? See docs/user.

.github/workflows/ci.yml classifies changed paths on pull requests and pushes to main, then runs only the affected quality gates:

• Classify changes: tests and runs .github/scripts/ci-change-classifier.cjs. Missing or truncated changed-file data fails safe by enabling every gate. Changes to the classifier or ci.yml also exercise every gate.
• Check: for product code, runs vp check (format and lint; this repo sets typeCheck: false in its lint options), vpr typecheck, the desktop build, and preload verification. Workflow-only changes keep the stable Check status but use GitHub's successful workflow parse instead of installing product dependencies.
• Test: runs vp run test across the workspace when product code or CI control files change.
• Mobile Native Static Analysis: runs vp run lint:mobile on macOS only when native mobile sources, their lint configuration, shared shell code, or dependency inputs change.
• Release Smoke: exercises release-only workflow steps through scripts/release-smoke.ts when package manifests, lock/workspace files, patches, release scripts, bundled mobile dependencies, or the release workflow change.

Documentation, Markdown/MDX, .github/VOUCHED.td, PR/issue templates, PR assets, plans, and .repos/** changes skip product checks. Unknown paths remain product changes. If classification fails, every existing gate runs rather than being bypassed.

.github/workflows/release.yml builds macOS (arm64 and x64), Linux (x64), and Windows (x64) desktop artifacts from a single v*.*.* tag and publishes one GitHub release. It auto-enables signing only when platform credentials are present. macOS passkey builds additionally require APPLE_TEAM_ID and the MACOS_PROVISIONING_PROFILE secret; Windows uses Azure Trusted Signing. Without the core signing credentials, it still releases unsigned artifacts.

See Release Checklist for the full release/signing setup checklist.