Add CI and release validation for the fork

[xodapi]

Why

The fork needs a durable validation path so changes are not only locally tested.

Scope

• GitHub Actions for npm test.
• Run npm run secret-scan.
• Validate source-only release archive build.
• Optionally run a small runtime smoke on a test port.

Acceptance criteria

• CI runs on PRs and pushes to main.
• Secret scan failures block merge.
• Release archive excludes local secrets and generated private state.