ci: check every change on GitHub Actions, publish by hand

[twister55]

Adds the two workflows from .claude/tasks/14-ci-release-pipeline.md, plus the CI badge in the README.

ci.yml

Runs on pull requests, on pushes to main, and on manual dispatch. One ubuntu-latest job mirroring the package scripts: pnpm lint → pnpm check → unit tests → pnpm build (which already covers svelte-package and publint).

Chromium is installed before the unit tests, because the client vitest project runs them in browser mode. The binaries are cached on the Playwright version; on a cache hit only the OS-level dependencies are reinstalled.

pnpm's version is pinned in the workflow instead of being read from packageManager — that field is not in package.json yet. Once it is, the version input can go.

There is no e2e step: no *.e2e.ts files exist yet, and playwright test exits 1 with "No tests found". It comes back with the first real e2e test.

release.yml

Manual only — workflow_dispatch, no push, tag or release triggers. Publishing needs external sign-off, so nothing here publishes by itself. The dry_run input defaults to true and runs npm publish --dry-run, which builds the tarball and prints its contents without touching the registry.

Before publishing, the job checks that the version in package.json is not already on npm. npm publish --dry-run never asks the registry, so without that check a dry run would pass and the real run would fail with a 403. The job also re-runs lint, types and the unit tests: workflow_dispatch can be launched from any branch, so a green CI on main says nothing about what is actually being published.

The real publish uses --provenance, which needs id-token: write and the repository field in package.json.

An NPM_TOKEN secret has to exist in the repository settings before the first real run.

The test change

autosize.svelte.test.ts asserted that the chart root stays exactly 240px after its container narrows to 200px. That holds only while the legend still fits the box, and how many rows the legend wraps to is a font metric: on Linux the labels are wider, the legend takes more rows than it does on macOS, the plotting area is squeezed to nothing and the root outgrows the element. The first CI run failed on exactly that, with expected 273 to be 240.

That behaviour is intentional — the next test starts from it — so the assertion is now relative: the legend's growth is measured, and the plot has to give up exactly that much, clamped at zero. Checked across container widths from 200px down to 110px, including the clamped case.

Not in this PR

The 0.1.0 version bump and CHANGELOG.md land separately, before the release. Until they do, Verify version is not published yet fails by design: 0.0.1 is taken by the placeholder on npm.

The peer-dependency matrix (svelte and uplot floors vs latest) is the second stage of the task and waits on the uplot floor audit.