ci: hasna/terminal has no GitHub Actions workflow — add a test+typecheck

[hasna-identity]

Objective

CI: hasna/terminal has no GitHub Actions workflow — add a test+typecheck gate on pull_request

Verification

• policy source: base d587d07 (immutable commit — agent-proof)
• ⚠️ GATE-INTEGRITY: agent touched verify-bearing config — REVIEW (.github/workflows/ci.yml)
• containment: env — allowlist env, non-login shell, run-scoped HOME (registry auth seeded for install)
• install: pass
• typecheck: pass
• build: pass
• test: pass
• doctor (ci): ok — 11 checks passed (1 advisory)

---

Run run_32384bac91f7 · backend codewith · task bb193c89-7c7b-42b7-a699-2de787f116f3
🏭 Generated by @hasnaxyz/factory

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

CI note (ops drain): the new workflow ran and caught a real env-dependent test — 'getTerminalDir default > returns a path ending with terminal' passes on dev hosts and in factory host-side verify but fails on the GitHub runner (236/237 pass otherwise). The gate is doing its job; the test needs to be made hermetic (derive expectation from the same env resolution the code uses) rather than weakening the workflow.

[andrei-hasna]

Closing. The workflow in this PR is correct — the repo is not ready for it.

Verified on run 30521234557 (job 90801878582). The job failed after 8 seconds on one test:

(fail) getTerminalDir default > returns a path ending with terminal
error: expect(received).toMatch(expected) Expected substring or pattern: /terminal$/

This is a real repo defect that CI correctly surfaced, not CI flake. src/paths.ts getTerminalDir() returns process.env.HASNA_TERMINAL_DIR or TERMINAL_DIR when either is set, before falling back to $HOME/.hasna/terminal. In src/paths.test.ts the beforeEach/afterEach that clears and restores those two variables belongs to the FIRST describe block only — the getTerminalDir default describe at line 90 has no such guard, and earlier tests set HASNA_TERMINAL_DIR to values including the literal /custom/path, which does not end in terminal.

Bun runs every test file in one process, so this only appears when the whole suite runs together — exactly what CI does and exactly what nobody does locally. That is the same disease hasna/evals #10 just fixed (a process-global mock.module leaking into later files), so it is worth looking for the pattern repo-wide rather than only at this one assertion.

Merging this would have installed a gate that is red on main from day one, which teaches people to ignore it.

Tracked as todos OPE103-00004 with the exact remedy: give that describe its own beforeEach deleting both variables, and prefer delete process.env.X over assigning "" — an empty string is falsy but still an assigned key. Confirm with a full-suite run, not a single-file run.

Also note this PR's workflow triggers on pull_request only. When it is re-opened, add push: branches: [main] so main itself stays measured — that is what the other four CI PRs merged today do.