[CI] Add baseline Go/Rust build and test checks

[Darkroom4364]

Context:
Manual verification from repo exploration:

• go build ./cmd/server.go passes.
• go test -vet=off ./... passes.
• go test ./... currently fails under vet because of one listener-manager formatting bug.
• cargo test passes for the agent.
• cargo build passes but emits warnings.

Proposed scope:

• Add a minimal CI workflow for server and agent checks.
• Start with build/test/vet only; avoid integration tests until local server/agent lifecycle is stable.
• Decide whether warnings should fail CI now or be tracked for later.

Acceptance criteria:

• CI runs server go test ./... and go build ./cmd/server.go.
• CI runs agent cargo test and cargo build.
• The workflow documents any platform/target assumptions.
• The current vet issue is fixed before enabling required CI.

[Darkroom4364]

Local implementation pass is ready in the workspace.

Added .github/workflows/ci.yml with hard gates for:

• Go server: go test ./..., go vet ./..., go build -o /tmp/microc2-server ./cmd
• Static/script checks: bash -n for shell scripts and node --check for web JS
• Rust agent: cargo test --locked, cargo clippy --locked --all-targets, cargo build --locked

Also stopped ignoring agent/Cargo.lock so the locked Cargo checks work in a clean GitHub Actions checkout.

Formatting is currently advisory because existing Go/Rust formatting drift would otherwise make the initial workflow red. Follow-up opened as #89 to clean formatting and promote that job to required.

[Darkroom4364]

Update: CI is now path-aware and Foxguard is no longer duplicated as a GitHub Actions job.

Current workflow shape:

• Detect Changes uses path filters.
• Go Server runs only for server/** or workflow changes.
• Rust Agent runs only for agent/** or workflow changes.
• Static Assets And Scripts runs for server/web/**, install.sh, agent/build.sh, or workflow changes.
• Format Advisory runs only for server/agent/workflow changes and remains non-blocking until [CI] Clean up formatting and promote format checks to required #89.
• workflow_dispatch runs everything manually.

Foxguard should be handled by the GitHub App/check. The repo keeps .foxguard.yml and baselines so current findings are tracked without making the first rollout noisy.

[Darkroom4364]

Foxguard app integration configured.

• Opened the Foxguard GitHub App install page for repository authorization.
• Removed the duplicate Foxguard GitHub Actions job; the app should own security review/check runs.
• Kept .foxguard.yml plus baselines in the repo for app/CLI consistency.
• Protected main with required status checks: Detect Changes, Go Server, Rust Agent, Static Assets And Scripts, and foxguard.
• Branch protection keeps admin bypass enabled for rollout safety; force pushes and deletions are disabled.

Note: the Foxguard GitHub App must be installed for the required foxguard check to appear on PRs.

[Darkroom4364]

CI/CD pipeline is now live on GitHub.\n\nImplemented branch-aware workflow and protections:\n- main is the stable promotion branch.\n- dev is the development integration branch.\n- issue branches should target dev; PRs into main are guarded to come from dev.\n- dev requires CI Gate and foxguard.\n- main requires CI Gate, Release Package, and foxguard.\n- CI Gate aggregates path-selected suites so branch protection does not depend on skipped optional jobs.\n- main/promotion runs all suites plus artifact packaging.\n\nLatest Actions runs are green for both dev and main. Format Advisory remains non-blocking until the existing formatting backlog is cleaned up.

[Darkroom4364]

Closing as complete. The CI/CD baseline is now live on GitHub with context-aware Go, Rust, static/script, and blocking format checks, plus the Foxguard GitHub App check and baseline configuration. Follow-up #89 was completed via #91 to make formatting and Foxguard baseline behavior blocking.