ci: add phase-1 GitHub Actions workflow (per-app matrix)

[jhamon]

What

Adds a CI workflow (.github/workflows/ci.yml) — the repo previously had no CI.

On push/PR to main (and manual dispatch), a matrix runs per sample app:

• Next.js apps (legal-semantic-search, pinecone-assistant [pnpm], shop-the-look) — install + lint + build
• namespace-notes — install client and server (via their real paths)
• shop-the-look FastAPI backend — pip install -r requirements.txt + compileall api

Handles the mixed package managers (npm + pnpm) and the client/server split. Token scoped contents: read.

Why / phase 1

This is a phase-1, informational CI: every job is continue-on-error, so it reports per-app status without blocking main. That's deliberate — several apps currently can't install/build cleanly:

• legal-semantic-search has broken file: deps (→ Dependency & lockfile hygiene: clear medium/low Dependabot, regenerate lockfiles, fix broken/unpinned deps #73)
• namespace-notes's own install:all script targets a stale server/node path (→ Dependency & lockfile hygiene: clear medium/low Dependabot, regenerate lockfiles, fix broken/unpinned deps #73); the workflow sidesteps it by installing the real dirs
• Pinecone SDK drift across apps (→ Upgrade & unify Pinecone SDK across apps (namespace-notes/server v2, python pinecone-client, next-auth beta) #74)

Flipping this matrix to a required gate is tracked in #71 and depends on #73/#74 landing. This PR establishes the CI surface and makes the current per-app failures visible in Actions.

Verification

YAML validated locally. Once merged (or via the PR run), the Actions tab shows per-app pass/fail — the intended signal.

Part of #71 (parent sweep #76).

🤖 Generated with Claude Code

[jhamon]

PR Feedback Autofix pass

The workflow itself is correct — the two red matrix cells are pre-existing app breakage the matrix is designed to catch (as the header comment intends), not defects in this PR:

• legal-semantic-search — npm ci ERESOLVE: the app pins openai to a file:langchain/llms/openai path (resolves to openai@undefined), which can't satisfy the openai peer required by @langchain/community / @browserbasehq/stagehand.
• pinecone-assistant — pnpm run lint: next lint reconfigures tsconfig.json on first run and exits 1 non-interactively in CI.

Both are real per-app remediation (dependency graph / committed tsconfig), out of scope for adding the workflow, so I filed #81 to track the fixes rather than scope-creep this PR.

Decision needed from you: for phase-1, do you want these two cells REQUIRED (PR stays red until #81 lands) or marked continue-on-error so the workflow can merge now and the failing apps are tracked in #81? I left the matrix as-is.

[jhamon]

Closing as superseded by #80 (ci: execution-based test gate for all sample apps, PIN-57), which merged to main on 2026-07-13.

Both PRs create .github/workflows/ci.yml; #80 delivers a superset of this PR's goal — one job per app, build + drive-while-running, with Pinecone mocked/gated so CI needs no live key. That's strictly more than this PR's phase-1 continue-on-error informational matrix, and #77 now conflicts on ci.yml.

No unique value left here. The follow-ups this PR referenced (#71/#73/#74) remain the right place to track flipping apps to a required gate. Closing to keep the worklist clean.