CI: the tests, and every plan built and linted

The trainer had no CI. Every push now runs the tests and builds every
plan under plans/ against the iris release the live sites run, and
lints the onboarding site.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitea/workflows/test.yml

@@ -0,0 +1,44 @@
+name: Test
+
+# Every push: the tests, then every plan under plans/ built and linted
+# with the iris release the live sites run, and the onboarding site
+# linted too. A plan that stops building, or a builder change that
+# renders a site the lint rejects, fails here and nowhere later.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: bare
+    env:
+      # The bare runner's shared toolchain and caches (see uhhm/portal).
+      CARGO_HOME: /var/local/cargo
+      RUSTUP_HOME: /var/local/rustup
+      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
+      SCCACHE_DIR: /var/local/sccache
+      SCCACHE_SERVER_PORT: "4228"
+      CARGO_TARGET_DIR: /var/local/cargo-target
+      # The lint, pinned to the portal release the sites run.
+      IRIS_RELEASE: v0.3.46
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Test
+        run: cargo test --release
+
+      - name: Build and lint every plan
+        run: |
+          set -euo pipefail
+          bin="$CARGO_TARGET_DIR/iris-$IRIS_RELEASE"
+          [ -x "$bin" ] || { curl -sfL "${{ github.server_url }}/uhhm/iris/releases/download/$IRIS_RELEASE/iris" -o "$bin" && chmod +x "$bin"; }
+          cargo build --release
+          for plan in plans/*.yaml; do
+            name=$(basename "$plan" .yaml)
+            echo "== $plan"
+            "$CARGO_TARGET_DIR/release/portal-trainer" build --plan "$plan" --out "/tmp/ci-$name" --lint "$bin"
+          done
+          echo "== portal-portal"
+          "$bin" check --path portal-portal/questions