ci: add CI workflow, PR template, branch protection, lockfile

- Add .github/workflows/ci.yml: test (Node 20+22) + build + Go build/test
- Add .github/pull_request_template.md: structured PR description
- Commit pnpm-lock.yaml for CI --frozen-lockfile reproducibility
- Branch protection: require CI pass on main, allow owner force push

.github/pull_request_template.md

@@ -0,0 +1,43 @@
+## Summary
+
+<!-- What does this PR do? Keep it to 1-3 bullet points. -->
+
+-
+
+## Type
+
+<!-- Check the one that applies -->
+
+- [ ] `feat` — New feature
+- [ ] `fix` — Bug fix
+- [ ] `docs` — Documentation only
+- [ ] `refactor` — Code refactoring (no behavior change)
+- [ ] `test` — Adding or updating tests
+- [ ] `chore` — Build, CI, dependency updates
+
+## Changes
+
+<!-- List the key files changed and why -->
+
+| File | Change |
+|------|--------|
+| `src/...` | ... |
+
+## Testing
+
+<!-- How was this tested? -->
+
+- [ ] `pnpm test` passes (134+ tests)
+- [ ] `pnpm build` succeeds
+- [ ] Manual testing: <!-- describe what you tested -->
+
+## Checklist
+
+- [ ] Code follows existing patterns in the codebase
+- [ ] No hardcoded secrets or API keys
+- [ ] Updated README/CHANGELOG if user-facing change
+- [ ] Single concern — not mixing unrelated changes
+
+## Related Issues
+
+<!-- Link related issues: Fixes #123, Related to #456 -->

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20, 22]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run tests
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build
+
+  go-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.21'
+
+      - name: Go build check
+        working-directory: codeagent-wrapper
+        run: go build -o /dev/null .
+
+      - name: Go test
+        working-directory: codeagent-wrapper
+        run: go test ./...

.gitignore

@@ -40,8 +40,8 @@ linux-do-post-update.md
 .claude/
 .magi/
 
-# Lock files (optional)
-pnpm-lock.yaml
+# Lock files
+# pnpm-lock.yaml is committed for CI reproducibility
 
 # Test directories
 ceshi/