Build CI with GitHub Actions

Opinionated, copy-paste recipes for the parts of CI that are easy to get subtly wrong: pinning toolchains, ordering setup steps so caching actually works, building Docker images with layer reuse, exposing a manual trigger, and validating the YAML before it ever runs.

Snippets below are deliberately minimal. For one complete workflow that wires Node + Rust + Docker together, copy reference/ci.yml.

Cross-cutting defaults (every workflow)

Bake these into the top of every workflow file, not as an afterthought:

permissions:
  contents: read          # GITHUB_TOKEN is read-write by default — clamp it