[Infrastructure]: Enable public GitHub Actions CI

[morning-verlu]

Goal

Add a public GitHub Actions CI workflow for KAI OS so visitors can see tests and Evidence Sample replay checks passing on main and pull requests.

Current blocker

A workflow file was prepared locally, but pushing .github/workflows/ci.yml was rejected because the current GitHub token does not have workflow scope:

refusing to allow a Personal Access Token to create or update workflow `.github/workflows/ci.yml` without `workflow` scope

Intended CI checks

./gradlew test installDist --no-daemon
build/install/kaios-cli/bin/kaios --version
build/install/kaios-cli/bin/kaios next --json
build/install/kaios-cli/bin/kaios capsule --file examples/evidence-sample/change-review.capsule.json --check
build/install/kaios-cli/bin/kaios replay --file examples/evidence-sample/change-review.capsule.json
scripts/quickstart-smoke.sh

Done when

• main has a visible CI badge in the README.
• Pull requests run the no-key test/install/evidence checks.
• The workflow uses Java 17 and the deterministic mock provider.
• The launch checklist links to the workflow run.

[morning-verlu]

Update from this pass:

Public .github/workflows/ci.yml is still blocked by the missing workflow token scope, so I did not close this issue.

Progress added on main:

• Added ./scripts/repository-ci-smoke.sh.
• Added copyable workflow template: examples/github-actions-repository-ci.yml.
• Updated docs/CI_SETUP.md, docs/VERIFY.md, examples/README.md, and README to point at the repository CI smoke path.

The smoke script covers the no-key CI trust path:

./gradlew clean test installDist --no-daemon
build/install/kaios-cli/bin/kaios --version
./scripts/evidence-samples-smoke.sh
build/install/kaios-cli/bin/kaios tour --dir <tmp> --json
build/install/kaios-cli/bin/kaios capsule --file <generated-tour-capsule> --check
build/install/kaios-cli/bin/kaios replay --file <generated-tour-capsule>

Verified locally with:

./scripts/repository-ci-smoke.sh

Pages deploy for e118709 completed successfully. Remaining work for this issue is still the actual workflow-file push after auth is refreshed with:

gh auth refresh -h github.com -s workflow

[morning-verlu]

Public CI enablement runbook is now on main in commit 7357411:

• Runbook: https://github.com/morning-verlu/KAI/blob/main/docs/CI_ENABLE_RUNBOOK.md
• Linked from docs/CI_SETUP.md, docs/LAUNCH.md, docs/CONTRIBUTOR_BOARD.md, and the June 17 launch snapshot.
• Remote raw file verified readable from main.
• Pages deployment for 7357411 completed successfully.

Important: I did not push .github/workflows/ci.yml in this pass. The active GitHub CLI token still lacks the workflow scope, so the actual workflow-file push remains blocked until the maintainer runs:

gh auth refresh -h github.com -s workflow
gh auth status

After workflow appears in the token scopes, the runbook gives the exact copy, local verification, push, GitHub Actions verification, and rollback steps. The intended CI trust path remains no-key and runs ./scripts/repository-ci-smoke.sh.