ci: enforce lint + strict tsc + tests + build on every PR (R22)

.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: CI
+
+# Enforces Rule R22 (lint + typecheck + tests + build pass before push) on
+# every PR and every push to main. The four gates mirror the local commands in
+# MANUAL_STEPS.md Step E.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies (exact lockfile)
+        run: npm ci
+
+      - name: Lint (errors fail; warnings reported)
+        run: npm run lint
+
+      - name: Type-check (strict mode)
+        run: npx tsc --noEmit -p tsconfig.app.json
+
+      - name: Unit tests
+        run: npm test
+
+      - name: Production build
+        run: npm run build

supabase/functions/verify-anchor-receipt/index.ts

@@ -1,4 +1,8 @@
 // Supabase Edge Function: verify-anchor-receipt (audit F4 residual)
+
+/* eslint-disable @typescript-eslint/no-explicit-any -- Deno edge function: raw JSON-RPC and
+   PostgREST JSON boundaries are deliberately untyped here; this file is excluded from the
+   Vite app typecheck and is type-checked by Deno at deploy time. */
 // Server-side confirmation of a Sepolia anchoring transaction.
 //
 // Why: products.blockchain_tx_status is currently manufacturer-asserted —

supabase/functions/verify-wallet-link/index.ts

@@ -1,4 +1,8 @@
 // Supabase Edge Function: verify-wallet-link (audit MEDIUM #7)
+
+/* eslint-disable @typescript-eslint/no-explicit-any -- Deno edge function: raw JSON-RPC and
+   PostgREST JSON boundaries are deliberately untyped here; this file is excluded from the
+   Vite app typecheck and is type-checked by Deno at deploy time. */
 // Server-side ECDSA verification of the wallet-linking signature.
 //
 // Why: `link_wallet_address` only FORMAT-checks the signature (^0x…130$) — the