Ops: enable GitHub Actions CI workflow push with workflow-scoped token

[vultrdev]

Objective

Publish the prepared CI workflow once GitHub auth has the workflow scope.

Current blocker

The current GitHub auth for vultrdev can push normal commits, but GitHub rejected workflow creation on push because the token does not have the workflow scope.

Already prepared locally

• .github/workflows/ci.yml

Done when

• auth includes workflow scope
• CI workflow is committed and pushed
• PRs and pushes validate npm install, npm run typecheck, and npm run build