ci: gate publish behind the release environment; run tests in CI

.github/workflows/ci.yml

@@ -13,10 +13,18 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          # Node 22: the test script passes a glob ('src/**/*.test.ts') to
+          # `node --test`, and glob support in the test runner only landed in
+          # Node 21. On Node 20 the pattern is treated as a literal path and
+          # the run dies with "Could not find .../src/**/*.test.ts".
+          # This is a dev-time constraint only — `engines` stays >=18 because
+          # installing the package runs `prepare` (tsc build), never the tests.
+          node-version: 22
           cache: npm
 
       - run: npm ci
+      - run: npm run type-check
+      - run: npm test
       - run: npm run build
 
   # Build and push a throwaway GHCR image for every PR so the branch can be

.github/workflows/release.yml

@@ -9,8 +9,13 @@ permissions:
   id-token: write
 
 jobs:
+  # Both jobs below target the `release` environment, which has required
+  # reviewers. Merging a version bump still auto-tags (see ci.yml), but nothing
+  # reaches npm, GHCR, or GitHub Releases until a reviewer approves the run.
+  # One approval unblocks every job in the run that targets the environment.
   release:
     runs-on: ubuntu-latest
+    environment: release
     steps:
       - uses: actions/checkout@v4
 
@@ -49,6 +54,7 @@ jobs:
   docker:
     name: Build and push container image
     runs-on: ubuntu-latest
+    environment: release
     permissions:
       contents: read
       packages: write