Park updated CI workflow in ci/ (push lacks workflow scope)

Commit notes

The branch's earlier commit updated .github/workflows/ci.yml (frontend gate, audit step, timeouts, main-only push triggers), but pushes from this automation cannot touch workflow files. This restores the active workflow byte-for-byte and stages the updated one in ci/ci.yml with apply instructions in ci/README.md — the same staging pattern used when CI was first added here.

[private session redacted]