Run CI on the self-hosted GitLab

Ports .github/workflows/ci.yml after the GitHub account was suspended and
Actions stopped being reachable. Same checks, same order, with the image
pinned by digest in place of the workflow's SHA-pinned actions.

cleanup.yml is not ported: it pruned GHCR through an action, and GitLab
keeps that as a container registry cleanup policy on the project rather
than as a pipeline. publish.yml and release.yml are larger and follow
separately.

The Actions workflows stay in the tree as the reference.

.gitignore blanket-ignores dotfiles, so .gitlab-ci.yml is negated there the
same way .github already is.

.gitignore

@@ -20,6 +20,7 @@ scripts/
 !.prettierrc
 !.env.development
 !.github/
+!.gitlab-ci.yml
 !.vscode/
 .vscode/*
 !.vscode/extensions.json

.gitlab-ci.yml

@@ -0,0 +1,39 @@
+# CI on the self-hosted GitLab, ported from .github/workflows/ci.yml when the
+# GitHub account was suspended on 2026-09-20. The Actions file stays in the
+# tree: it is the reference this was written from and works unchanged if the
+# appeal succeeds.
+#
+# The image is pinned by digest, with its tag in the trailing comment -- the
+# replacement for the workflow's SHA-pinned actions, since GitLab has no
+# action allowlist.
+#
+# Not ported here:
+#   * cleanup.yml pruned GHCR with dataaxiom/ghcr-cleanup-action; on GitLab
+#     that belongs in the project's container registry cleanup policy, not in
+#     a pipeline.
+#   * publish.yml and release.yml still need doing; they are larger and are
+#     being handled separately.
+
+stages: [build]
+
+default:
+  interruptible: true
+
+build:
+  stage: build
+  image: node:22-bookworm-slim@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9 # 22-bookworm-slim
+  variables:
+    NPM_CONFIG_CACHE: "$CI_PROJECT_DIR/.npm"
+  cache:
+    key:
+      files: [package-lock.json]
+    paths: [.npm/]
+  script:
+    - npm ci --ignore-scripts
+    - npm run typecheck
+    - npm run lint
+    - npm test
+    - npm run build
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH