ci: build and test on every push and PR, GPU tests on lavapipe

The repo had no CI. The suite is headless and the crate builds
standalone, so a GitHub Actions job on ubuntu-24.04 covers it:

- installs libwayland-dev (wayland-sys links it via pkg-config) and
  mesa-vulkan-drivers, whose lavapipe is a software Vulkan device;
- builds all targets and runs the tests with default features, then
  the tests with all features (cce-vault is a public git dependency);
- RUSTFLAGS=-D warnings, since the tree builds warning-free;
- fails the job if the vk:: tests printed their "skipping" note: they
  pass when no device opens, so losing lavapipe would otherwise drop
  the only rendered checks silently.

Verified locally in an Ubuntu 24.04 container: 546 lib tests and the
integration tests pass with all features and -D warnings; with
lavapipe the five GPU tests run, and with the ICD hidden the last step
fails as intended. No clippy or rustfmt step: clippy has deny-level
findings (not_unsafe_ptr_arg_deref in context.rs) and the tree is not
rustfmt-clean, so either would fail on day one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NwZ8nBQYEej9ic3tVC5v7Z

 .github/workflows/ci.yml | 59 ++++++++++++++++++++++++++++++++++++++++++++++++
 CLAUDE.md                |  8 +++++++
 2 files changed, 67 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..72774aa
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  # The tree builds without warnings; keep it that way. (Dependencies are
+  # capped by cargo and unaffected.)
+  RUSTFLAGS: -D warnings
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      # libwayland-dev: wayland-sys links libwayland-client through pkg-config.
+      # mesa-vulkan-drivers: lavapipe, a software Vulkan device, so the GPU
+      # tests (vk::compute, vk::plate_probe) run instead of skipping.
+      - name: Install system packages
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            pkg-config libwayland-dev libvulkan1 mesa-vulkan-drivers
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Build (default features)
+        run: cargo build --all-targets
+
+      - name: Test (default features)
+        run: cargo test
+
+      # `markdown` pulls cce-vault (a public git dependency); `doc_editor`
+      # has none.
+      - name: Test (all features)
+        run: cargo test --all-features
+
+      # The GPU tests skip with a note when no Vulkan device opens, and a
+      # skipped test passes. Fail instead if they skipped here, so losing
+      # lavapipe does not quietly drop the only rendered checks.
+      - name: GPU tests ran on a real device
+        shell: bash
+        run: |
+          cargo test --lib vk:: -- --nocapture 2>&1 | tee vk-tests.log
+          if grep -i "skipping" vk-tests.log; then
+            echo "::error::the Vulkan tests skipped: no device opened on the runner"
+            exit 1
+          fi
diff --git a/CLAUDE.md b/CLAUDE.md
index 1eff3dc..ab8f961 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -56,6 +56,14 @@ scattering of widgets (`text_box`, `slider`, `dropdown`, `treelist`, …). When
 engine, that module's tests are the fast feedback loop; run `cargo test -p cce-ui scene::` before
 anything else.
 
+CI (`.github/workflows/ci.yml`, every push and PR) builds and tests on Ubuntu 24.04 with
+default and with all features, warnings as errors. It installs `libwayland-dev` (the build
+links libwayland-client through pkg-config) and Mesa's lavapipe, a software Vulkan device,
+so the GPU tests (`vk::compute`, `vk::plate_probe`) RUN there rather than skip — and a
+last step fails the job if they printed a skip note, since a skipped test passes. To match
+it locally: `apt install libwayland-dev mesa-vulkan-drivers`, then
+`RUSTFLAGS="-D warnings" cargo test --all-features`.
+
 Wayland protocol bindings are generated **inline at compile time** by `wayland-scanner` macros in
 `src/protocol.rs` from `protocol/*.xml` (`cce-inspector-v1`, `cce-window-management-v1`) — there is
 no `build.rs` and no codegen step to run.