No CI workflow runs the quality gate — make check never runs on a PR

[AmitAvital1]

Background

The quality gate already exists locally. Makefile defines:

check:    lint typecheck test   # ruff check + mypy + pytest
validate: agentctl validate examples/enterprise-knowledge-assistant/agents.yaml

Nothing runs either of these in CI. .github/workflows/ contains only release-please.yml, which handles versioning and container publishing on push to main — it never lints, type-checks, or tests anything. A PR with a broken test, a type error, or a lint failure can merge today with no automated signal.

Goal

1. Add a workflow (e.g. .github/workflows/ci.yml) triggered on pull requests and pushes to main, running make check and make validate.
2. Turn that workflow into a required status check via branch protection on main, so a PR can't merge while it's red.

Non-goals

• Writing new tests — this issue only wires up what already exists (make check, make validate). Expanding coverage with example-YAML and mocked-LLM e2e tests is a separate, follow-up issue — once that lands, this same workflow is what runs it.
• Multi-version Python matrix, dependency caching tuning, etc. — start with the single version pinned in pyproject.toml (requires-python = ">=3.11,<4.0"); revisit only if it becomes a real pain point.