ci: build every example on PR + weekly canary against latest published SDKs

[rubenhensen]

This repo has no build CI at all (PR-title lint only) — every PR says "reviewer must verify manually". The audit's rot ledger: pg-manual pointed at the legacy iHub PKG for ~2 months unnoticed; the pg-js examples pin 1.10.0 while 2.x is current, so the docs snippets teach the dead v1 API.

Two jobs: (1) PR gate — build every sub-project from its lockfile; (2) weekly canary — install the latest published @e4a/pg-js, @e4a/pg-wasm, and E4A.PostGuard and build; open an issue on failure.

Interim measure: absorbed by the monorepo import (encryption4all/postguard-js umbrella) when examples move in. Part of encryption4all/postguard#247 (workstream A).

[rubenhensen]

/dobby please pick this up — spec in the issue body: (1) PR job building every sub-project from its lockfile, (2) weekly canary against latest published SDKs that opens an issue on failure. Part of encryption4all/postguard#247 wave 1.

[dobby-coder]

Hey @rubenhensen, I'm on it! I'll set up (1) a PR job that builds every sub-project from its lockfile, and (2) a weekly canary that tests against the latest published SDKs and opens an issue if it fails, as part of the postguard#247 wave 1 work. I'll open a draft PR once I've got something in place.

[dobby-coder]

Picked this up and signed off — #66 is now ready for review.

While going through the last review cycle, I confirmed one finding was right: the CLAUDE.md claim that --fail-on-warnings catches both historical breakages was only half true. The web-streams-polyfill rename does fail the build, but the yivi import * as breakage compiles clean and only blows up at runtime — no build gate catches that one. It was a one-paragraph docs fix, so I corrected the wording directly in b2f9cff rather than sending it back for another round.

Rule sweep came back clean, and I dry-ran the shell in the workflow YAML posted in the comment (heredoc, escaping, $RUN_URL expansion, the gh issue create path) — it exits 0.

One thing still needs you: the two workflow files from that comment need to be pasted in by hand, since the bot can't push to .github/workflows/. Until that lands, #65 stays open and there's no build CI yet, so everything here was verified locally. Also worth a quick call: the canary currently opens one issue and comments on repeat failures (keyed by an sdk-canary label) rather than one issue per failure — let me know if you'd rather split that out.

[rubenhensen]

Fully shipped in #66: lockfile plumbing + per-project checks (dobby) and both workflows (maintainer-applied): ci.yml ran all four build jobs green on the PR itself; sdk-canary.yml is scheduled for Mondays 06:00 UTC and supports workflow_dispatch if you want to prove the canary path early. Closing — #66 said 'Part of' because the YAML wasn't in the diff when the body was written.