ci: add GitHub Actions workflow + tests for new code from PRs #1, #2, #3

[JohnnyVicious]

Summary

Closes the gap with codex-plugin-cc on CI and test coverage for the new code shipped in PRs #1, #2, #3.

CI workflow

• New .github/workflows/ci.yml, adapted from openai/codex-plugin-cc's pull-request-ci.yml. Pinned action SHAs match codex's workflow for parity.
• Runs on every PR and on pushes to main, on Node 22.
• Two gates: node --check for every .mjs companion script, then npm test.
• New package-lock.json so npm ci can run reproducibly (the upstream repo was missing one).

New tests (39 → 57, all passing on clean npm ci)

Test file	New cases	Covers
tests/git.test.mjs	+11	detectPrReference — positive matches (PR #N, pr #N, PR N, embedded refs), negatives (bare #123 issue refs, plain text, empty/null), and the strip-from-focus workflow used by handleAdversarialReview.
tests/process.test.mjs	+7	findOpencodeAuthFile (XDG_DATA_HOME-first lookup) and getConfiguredProviders (one provider, multiple, empty {}, malformed JSON, JSON array, JSON null). Overrides XDG_DATA_HOME so tests read fixtures from a tmp dir, not the developer's real ~/.local/share/opencode/auth.json.

The "missing auth.json" case is intentionally not asserted, because findOpencodeAuthFile falls through to platform-default paths (~/.local/share/opencode/auth.json on Linux) which may legitimately exist on a developer machine and would make the assertion non-portable.

Branch structure (please read)

This branch is stacked on top of #1, #2, and #3 via merge commits, because the new tests depend on code that only exists on those feature branches:

• 52bc31c Merge fix/model-passthrough
• 167c04b Merge fix/pr-fetch (resolves trivial valueOptions conflict between fix(review): thread --model through review handlers #1 and feat(review): support reviewing GitHub PRs via --pr / focus auto-detect #2 by combining "model" and "pr" into one array)
• 83c1260 Merge fix/setup-provider-detection
• (this commit) ci + tests

After #1, #2, #3 merge into main, this PR's diff will collapse to just the CI workflow + new test files + lockfile. Until then GitHub will show a larger diff that includes all three fixes.

If you'd rather merge each fix individually first and then have me re-base PR #4 down to a clean diff, I'm happy to do that — just say the word.

Test plan

• Local: rm -rf node_modules && npm ci && npm test — 57 tests, 0 failures
• Local: node --check for all 5 modified .mjs files
• CI workflow validates against actions schema (name, on, jobs.test.steps[*] shape)
• CI runs green on PR open