ci: fork-side preview mirror (codeql + windows dual-mode) for the fix head

Author: moc

.github/workflows/preview.yml

@@ -0,0 +1,44 @@
+# preview.yml — fork-side pre-push preview gate (CodeQL + Windows).
+# Lives on mirror branches (preview/**) in the modacker fork ONLY; never part
+# of any upstream PR diff. Trigger: push to preview/** branches.
+# Rationale: the upstream marketplace CI covers validate (ubuntu) only;
+# CodeQL and Windows evidence before push are the two blind spots this
+# workflow closes. Author: modacker, 2026-09-20 (webui-rigor-fix batch).
+name: preview
+on:
+  push:
+    branches: ['preview/**']
+  workflow_dispatch:
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      security-events: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript
+      - uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:javascript'
+  windows:
+    runs-on: windows-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Plugin suite (module-mock flag, full surface)
+        working-directory: plugins/Wzdhehe/mcode-webui
+        shell: bash
+        run: |
+          node --experimental-test-module-mocks --test test/*.test.js checks/*.check.mjs \
+            test/integration/*.test.js test/matrix/*.test.js
+      - name: Plugin suite (flagless, root-gate shape)
+        working-directory: plugins/Wzdhehe/mcode-webui
+        shell: bash
+        run: node --test test/*.test.js test/integration/*.test.js test/matrix/*.test.js