[Task]: No public CI workflows, and the Makefile references a ci/pipeline.yml that is not in the repository

Task type

Other

Current state

The repository has no CI configuration. At commit 13b6811 there is no
.github/workflows/ directory and no ci/ directory; .github/ contains only
ISSUE_TEMPLATE/ and PULL_REQUEST_TEMPLATE.md.

The Makefile refers to a pipeline file that is not in the tree. Makefile:41-44:

# Mirrors the repository-wide header gate plus the desktop half of the CI
# validate and monorepo-gate stages (ci/pipeline.yml). CI additionally rebuilds
# the binaries and runs the Go suites; use make build-binaries and
# make test-services for those.

ci/pipeline.yml does not exist here, so a contributor reading the Makefile is
pointed at something they cannot open, and cannot tell which gates a maintainer
will actually run against their pull request.

The consequence for an outside contributor: CONTRIBUTING.md asks them to run the
gates by hand, nothing verifies a pull request automatically, and a missing SPDX
header or a failing Go suite surfaces only in human review - which CONTRIBUTING.md
says will send the change back.

Desired result

Concrete completion condition - either of the following.

(a) A GitHub Actions workflow that runs on pull_request and on push to main and
executes the documented gates, so a contributor sees the same verdict a
maintainer would:

  - node scripts/spdx-headers.mjs   (dependency-free; runs in a fresh clone
    before any install)
  - the desktop gates: npm ci, npm run verify:build-scripts, npm run lint,
    npm run typecheck, npm run service-contracts:check, npm run test:unit,
    npm run dead-code:check
  - go test ./... in every services module, plus services/tests

"make check" (Makefile:45) and "make test" (Makefile:47) already wrap most of
this on Linux and macOS; note that "make check" deliberately omits
dead-code:check, per AGENTS.md.

A matrix over ubuntu-latest / macos-latest / windows-latest would match the
stated support surface. A Linux-only job would still be a large improvement
over none.

(b) If CI is intentionally internal-only and not mirrored to this repository,
then correct Makefile:42 so it does not reference a path that is absent here,
and say in CONTRIBUTING.md that pull requests are validated by an internal
pipeline that contributors cannot see or run.

Either one resolves the mismatch. (a) additionally gives contributors a
pre-review signal.

Relevant paths or references

• Makefile:42 - the ci/pipeline.yml reference
• Makefile:45 - the "check" target (headers, verify, lint, typecheck, contracts,
  test-desktop)
• Makefile:47, 118, 123 - "test", "test-desktop", "test-services"
• CONTRIBUTING.md, "Development Setup" - the by-hand command list
• AGENTS.md, "Checks" - notes that "make check" omits dead-code:check, and that
  Windows runs the npm and go commands directly
• scripts/spdx-headers.mjs - the header gate
• services/readme.md, "Testing" - per-component and cross-process suites, and
  which tests skip themselves
• .github/ - currently ISSUE_TEMPLATE/ and PULL_REQUEST_TEMPLATE.md only

Validation

• Open a pull request that deliberately omits the SPDX header on a new file and
  confirm the workflow fails on it, then passes once the header is added.
• Confirm the workflow's gate list matches what CONTRIBUTING.md and AGENTS.md tell
  contributors to run, so the two cannot drift apart.
• Note for whoever implements this: services/readme.md documents that some Go
  tests skip themselves when a well-known port (11434, 14319, 14321) is in use or
  no mDNS responder is available, and that live-engine tests run only under
  NVPAIR_LIVE_OLLAMA / NVPAIR_LIVE_LMSTUDIO. A skip is not a pass, so the workflow
  should make skips visible rather than let them read as green.
• For (b): confirm that no path referenced by the Makefile is absent from the
  repository.

Confirmations

• I searched existing issues for duplicates.
• I agree to follow the Code of Conduct.