chore(delivery): align BT6 build and release gates (#160)

Make the contributor, CI, package, and tagged-release contracts agree with the shared BT6 baseline while preserving T3MP3ST's project-specific integrity checks. Exclude workspace-only material from published packages and keep local-agent detection tests host-independent.\n\nCloses #159

.github/workflows/ci.yml

@@ -2,13 +2,24 @@ name: T3MP3ST CI
 
 on:
   pull_request:
+    branches: [main]
   push:
     branches:
       - main
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: t3mp3st-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -35,3 +46,35 @@ jobs:
       # Non-network smoke: core traps run deterministically; server/live tiers
       # auto-skip when no server/LLM is present (they are absent in CI).
       - run: npm run smoke
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          ref: ${{ github.sha }}
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run test:release
+      - run: npm audit --audit-level=high
+      - run: npm run pack:dry-run
+      - run: npm pack --json > pack-result.json
+      - name: Record release checksums
+        run: |
+          package_file="$(node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync('pack-result.json')); process.stdout.write(p[0].filename)")"
+          sha256sum "$package_file" > SHA256SUMS
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: tested-package-${{ github.sha }}
+          path: |
+            *.tgz
+            SHA256SUMS
+            pack-result.json
+          if-no-files-found: error
+          retention-days: 14