[shahbazdalazyprogrammer]

Summary

• Adds the first GitHub Actions CI workflow for pull requests and pushes to main.
• Uses Node.js 22 and pnpm 9.15.0.
• Installs dependencies with pnpm install --frozen-lockfile.
• Adds a blocking build check for core workspace packages:
  • @ai-pass/shared
  • @ai-pass/auth-core
  • @ai-pass/platform-core
• Adds non-blocking baseline visibility jobs for repository-wide package type checking and the full monorepo build.
• Synchronizes pnpm-lock.yaml with the root @playwright/test devDependency.

Validation performed locally

• pnpm install --frozen-lockfile — passed after lockfile synchronization.
• pnpm dev:web — ran locally after building required workspace package outputs and configuring a local-only NEXTAUTH_SECRET.
• pnpm typecheck:ci — currently fails on main in @ai-pass/governance with 24 pre-existing TypeScript errors.
• pnpm build — currently fails on main first in @ai-pass/wallet because Node typings for process are unavailable and an unused parameter is rejected.
• pnpm exec turbo run build --filter=@ai-pass/web... — also reaches the known wallet and governance failures.

Known baseline findings

• The original pnpm-lock.yaml was out of sync with root package.json; frozen installation failed because the lockfile did not include @playwright/test.
• @ai-pass/governance has existing type-contract drift with @ai-pass/shared.
• @ai-pass/wallet currently fails to build due to missing Node type definitions and an unused parameter.
• pnpm reports that pnpm.overrides in the root package.json is ignored; this is recorded as a separate follow-up configuration concern.

Validation status - after running the workflow

• Core workspace build: passing
• Repository-wide typecheck: non-blocking baseline; currently blocked by
  @ai-pass/governance#build
• Full monorepo build: non-blocking baseline; currently blocked by
  @ai-pass/wallet#build

Baseline issues surfaced

@ai-pass/wallet

• Missing Node type declarations for process
• Unused monthlyBudgetUsd parameter

@ai-pass/governance

• Shared public API drift: MonitoringEvent and PolicyStatus are not exported
• Governance payload/schema mismatch in policy-enforcement-engine.ts
• Multiple unused imports and variables
• Duplicate object keys in legacy inventory data

Scope

This PR does not add deployment, real OAuth testing, external API-key usage, or production secrets.