ci: run tests and typecheck for real

The test step was a no-op stub. CI now installs at the repo root (where
bun.lock and bunfig.toml live), builds via the root script, typechecks,
and runs bun test. Adds 'just verify' as the same local gate (tests +
typecheck + build). Full lint stays out of the gate until the planned
feature stripping lands.

1 files changed, 8 insertions, 0 deletions

diff --git a/justfile b/justfile
index c7b65dc8..9c264b8a 100644
--- a/justfile
+++ b/justfile
@@ -44,6 +44,14 @@ typecheck:
 format:
     cd apps/web && bun run format
 
+# Full local quality gate: tests, typecheck, production build.
+# Full lint is NOT part of the gate yet (~112 pre-existing upstream errors);
+# lint the files you touched with `just lint`.
+verify:
+    bun test
+    cd apps/web && bunx tsc --noEmit
+    bun build:web
+
 # Build the Rust WASM package (run ./script/setup-rust once first)
 wasm:
     bun build:wasm