feat(ci): add PR, release workflows

.github/actions/setup-tangram/action.yml

@@ -0,0 +1,35 @@
+name: Setup Tangram CI Directory
+description: Configure /opt/tangram as the Tangram build directory for CI
+
+runs:
+  using: composite
+  steps:
+    - name: Create /opt/tangram directory
+      shell: bash
+      run: mkdir -p /opt/tangram/bin
+
+    - name: Write config
+      shell: bash
+      run: |
+        cat > /opt/tangram/config.json <<'CONFIG'
+        {
+          "directory": "/opt/tangram",
+          "remotes": [{
+            "name": "default",
+            "url": "https://staging.tangram.dev"
+          }]
+        }
+        CONFIG
+
+    - name: Create tangram wrapper
+      shell: bash
+      run: |
+        cat > /opt/tangram/bin/tangram <<'WRAPPER'
+        #!/bin/sh
+        exec tangram --config /opt/tangram/config.json "$@"
+        WRAPPER
+        chmod +x /opt/tangram/bin/tangram
+
+    - name: Set TG_EXE
+      shell: bash
+      run: echo "TG_EXE=/opt/tangram/bin/tangram" >> "$GITHUB_ENV"

.github/workflows/pr.yaml

@@ -0,0 +1,34 @@
+name: PR Validation
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+jobs:
+  test:
+    name: Test (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    environment: test
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: aarch64-darwin
+            runner: [self-hosted, macOS, ARM64]
+          - platform: x86_64-linux
+            runner: [self-hosted, Linux, X64]
+          - platform: aarch64-linux
+            runner: [self-hosted, Linux, ARM64]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - uses: ./.github/actions/setup-tangram
+      - run: bun install --frozen-lockfile
+      - name: Verify formatting
+        run: |
+          bun run auto --format
+          git diff --exit-code
+      - name: Check
+        run: bun run auto --check
+      - name: Test
+        run: bun run auto --test --retry

.github/workflows/release.yaml

@@ -0,0 +1,27 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  release:
+    name: Release (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    environment: release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: aarch64-darwin
+            runner: [self-hosted, macOS, ARM64]
+          - platform: x86_64-linux
+            runner: [self-hosted, Linux, X64]
+          - platform: aarch64-linux
+            runner: [self-hosted, Linux, ARM64]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - uses: ./.github/actions/setup-tangram
+      - run: bun install --frozen-lockfile
+      - run: bun run auto --release