CI pipeline and gates

CI repeats the local gate on GitHub's machines, adds the device lanes a laptop cannot run every night, and starts store builds only when a person decides. Three workflows do it (ci.yml: npm run verify on every pull request and push; devices.yml: Android emulator and iOS simulator lanes nightly; release.yml: an EAS build by hand behind a protected environment), with every action pinned to a commit SHA and every runner and tool pinned to a version. Two checkers prove it. Verified on 2026-10-14 against the ubuntu-24.04 and macos-26 runner-image READMEs, actionlint 1.7.12, Expo SDK 57, Node 26.4.0, Xcode 26.6 and eas-cli 24.10.0; the device jobs were not run on GitHub.

Rules that must hold