Add CI, version stamping, and the high-consequence two-key rule

Why: PR test evidence depended on the agent's word (single point); the
running binary could not answer what combination it was built from; and
irreversible operations lacked an explicit agent-stops-here boundary.
Evidence: Gitea runner online (home-runner, ubuntu-latest+docker); make
version prints describe+component SHAs; two-key line maps to baseline hard
boundary 1. CI first run observed on this PR before merge (see Actions tab).
Impact: .gitea/workflows/ci.yaml runs make test + make build on PR/push;
Makefile injects main.version (make version / agent-system version);
AGENTS.md and adoption register the two-key rule. No product code change.
Refs: policy/adoption.md; release-operations requirements

.gitea/workflows/ci.yaml

@@ -0,0 +1,27 @@
+name: ci
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Configure submodule auth over HTTPS
+        run: git config --global url."https://weichen:${{ secrets.GITEA_TOKEN }}@git-home.u1680832.nyat.app:30319/".insteadOf "ssh://git@git-ssh.u1680832.nyat.app:31411/"
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.27"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: Combination test (core + backend + frontend)
+        run: make test
+      - name: Build the single binary
+        run: make build