ci: give this repo a gate, and let green PRs ship themselves

[catomean]

HamsterCheek had no CI at all. npm run verify (typecheck + lint + vitest) has existed since the seed commit and was only ever run by hand — which, for a repo built by dispatched agents, means it was not run. Two of the three commits here landed with nothing checking them.

That also made this the one active project that could not participate in the fleet's auto-merge: the sweep refuses to merge a PR with zero checks, so "green PRs merge and deploy themselves" was structurally impossible here.

What's added

• ci.yml — npm run verify, then migrate + next build.
• auto-merge.yml + scripts/ci/auto-merge-sweep.sh — ported from the fleet.

The build needs a real database: the home page reads DATABASE_URL at module scope, so page-data collection dies with DATABASE_URL is not set on a bare runner. I verified that rather than assuming it. A schema-only Postgres service covers it — the build needs the queries to run, not to return rows. verify itself needs no DB, since the unit tests are pure.

Two deliberate deviations from the fleet template

1. The sweep drains oldest-first. Upstream merges the first PR gh pr list returns, which is newest-first, so an older green PR can wait indefinitely. Observed in fleetcrown today: two consecutive sweeps merged the two newest PRs while three older green ones were never even evaluated. Fixed there as #182 — no reason to seed a known starvation bug into a new repo.

2. The cron is hourly, not */10. This repo is private, so Actions minutes are billed; every other repo running this sweep is public, where scheduled runs are free. At */10 the safety net alone would burn ~4,300 billed minutes/month (144 runs/day, each rounded up) against a 2,000-minute allowance — mostly to discover there are no PRs. Hourly costs ~720. Latency barely changes, because the common path is workflow_run, which fires within seconds of CI going green. Make the repo public and */10 becomes free again.

Bootstrap note

GitHub only runs the default branch's copy of schedule / workflow_run workflows, so this PR cannot merge itself — the same one-time manual merge every fleet repo needed. ci.yml runs on this PR immediately, so the gate is provable before anything lands.

Verified: npm run verify green locally — typecheck, lint, 6/6 tests.

🤖 Generated with Claude Code

[catomean]

Pushed checks: read + statuses: read onto this branch before it lands.

This repo is private, and the auto-merge workflow being copied here omits those two scopes. That omission is invisible on a public repo — it works in ~20 of them — but on a private repo the sweep's statusCheckRollup query dies with Resource not accessible by integration and merges nothing, ever. That is exactly what happened in ivy-portal (fixed in bitbaum/ivy-portal#4), where it went unnoticed for as long as it did because a repo that merges nothing is indistinguishable from a repo with nothing ready to merge.

Without this, merging #3 would have given this repo a gate that never opens. Template also fixed at source in bitbaum/dotfiles#6.