docs: expand CONTRIBUTING.md with external contributor workflow #107

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	check:
	strategy:
	# Without this, the first failing leg cancels the others: the last three red
	# runs on main show macOS failed and Windows/Linux `cancelled`, so there is no
	# record of whether the other two platforms were fine. Keep every leg reporting.
	fail-fast: false
	matrix:
	os: [windows-latest, macos-latest, ubuntu-latest]

	runs-on: ${{ matrix.os }}

	steps:
	- uses: actions/checkout@v7

	- name: Set up Node.js
	uses: actions/setup-node@v6
	with:
	node-version: '22'
	cache: npm

	- name: Install dependencies
	run: npm ci

	- name: Start Xvfb (Ubuntu only)
	if: runner.os == 'Linux'
	run: \|
	sudo apt-get update
	sudo apt-get install -y xvfb
	export DISPLAY=:99
	sudo Xvfb :99 -screen 0 1920x1080x24 > /dev/null 2>&1 &

	- name: Verify
	run: npm run check
	env:
	DISPLAY: ':99.0'

	# One platform is enough: the dependency tree is the same everywhere, and this should report a
	# newly disclosed advisory rather than three copies of it. Kept out of `npm run check` so a
	# published advisory never blocks local development on an unrelated change.
	- name: Audit dependencies
	if: runner.os == 'Linux'
	run: npm audit --audit-level=moderate

Provide feedback