chore(delivery): align BT6 build and release gates (#160)

Make the contributor, CI, package, and tagged-release contracts agree with the shared BT6 baseline while preserving T3MP3ST's project-specific integrity checks. Exclude workspace-only material from published packages and keep local-agent detection tests host-independent.\n\nCloses #159

.github/pull_request_template.md

@@ -0,0 +1,36 @@
+## Summary
+
+<!-- What changed and why? -->
+
+## Linked issue
+
+Closes #
+
+## Contribution receipt
+
+- Scope class: docs_only | static_fixture | local_lab | ctf_range | authorized_live
+- Target authority:
+- Network use: none | loopback | private_lab | authorized_external
+- Claims or evidence changed:
+- Redaction/provenance notes:
+
+## Verification
+
+- [ ] `npm run typecheck`
+- [ ] `npm test`
+- [ ] `npm run doctor`
+- [ ] Risk-specific checks are listed below, or not applicable with a reason
+
+Exact commands and results:
+
+## Risk and rollback
+
+- Residual risk:
+- Rollback:
+
+## Delivery checks
+
+- [ ] Diff is scoped against current `upstream/main`
+- [ ] No unrelated protected evidence, safety tests, or provider/config files were removed
+- [ ] Published review history was not force-pushed
+- [ ] Exact-head CI must be green before merge

.github/workflows/ci.yml

@@ -2,13 +2,24 @@ name: T3MP3ST CI
 
 on:
   pull_request:
+    branches: [main]
   push:
     branches:
       - main
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: t3mp3st-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -35,3 +46,35 @@ jobs:
       # Non-network smoke: core traps run deterministically; server/live tiers
       # auto-skip when no server/LLM is present (they are absent in CI).
       - run: npm run smoke
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          ref: ${{ github.sha }}
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run test:release
+      - run: npm audit --audit-level=high
+      - run: npm run pack:dry-run
+      - run: npm pack --json > pack-result.json
+      - name: Record release checksums
+        run: |
+          package_file="$(node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync('pack-result.json')); process.stdout.write(p[0].filename)")"
+          sha256sum "$package_file" > SHA256SUMS
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: tested-package-${{ github.sha }}
+          path: |
+            *.tgz
+            SHA256SUMS
+            pack-result.json
+          if-no-files-found: error
+          retention-days: 14