Blog CMS dependency upgrades merge without a build check #30

Dependency upgrades to the Datum.net blog CMS merge blind, because no check installs or builds it on a push or pull request. That already blocks #29, which patches high-severity advisories in the Strapi tree and carries only CLA and Polylane checks. The repository already has npm run lint and npm run build, and the build compiles the Strapi admin panel, so it fails on an incompatible plugin or React version.

Acceptance criteria

• A workflow runs npm ci, lint and build on every push to main and every pull request: ci: Lint and build the CMS on every push and PR #32, on Node 22. Matching it to the Strapi Cloud setting is part of Move the blog CMS from Node 22 to Node 26 #34
• The workflow fails on a known-incompatible dependency bump, shown on a throwaway branch: https://github.com/datum-cloud/datum.net-cms/actions/runs/40710592311
• The build passes on main once the workflow merges: https://github.com/datum-cloud/datum.net-cms/actions/runs/40716978896
• The advisory patch shows a passing or failing build from it: fix(deps): patch high-severity advisories in CMS dependency tree #29 was superseded by fix: Patch high-severity advisories in the blog CMS #35, which passes https://github.com/datum-cloud/datum.net-cms/actions/runs/40717820116

Related to https://github.com/datum-cloud/engineering/issues/414