ci: restore test pipeline and keep test coverage in sync

[samiriasbeck]

Summary

This PR restores the GitHub Actions test pipeline and removes duplication between the workflow and the canonical test scripts declared in package.json.

Problem

The current tests workflow stops at npm ci before executing any test because the root lockfile is out of sync with package.json.

Observed mismatch:

• @lovable.dev/vite-tanstack-config: manifest 2.8.4, lockfile 2.8.2
• @lovable.dev/vite-plugin-hmr-gate: incompatible transitive lock entry
• root package version: manifest 0.1.80, lockfile 0.1.55

The workflow also maintains its own manual list of test files, which has drifted from the npm test definition.

Changes

• Synchronize package-lock.json with the current package manifest.
• Replace duplicated test-file lists in .github/workflows/test.yml with the canonical npm test command.
• Keep Node.js 22 as the test runtime.

Validation

Before the patch:

• npm ci fails with EUSAGE
• no test suite is executed

After the patch:

• npm ci --ignore-scripts --no-audit --no-fund succeeds from a clean install
• npm test passes
• 123 tests passed
• 0 failures
• 0 skipped
• Prettier check and git diff --check pass

The validated suites include trust scoring, Ed25519 attestations, release signing, adversarial evaluation, prompt-injection protection, runtime guardrails, content auditing, and integrations.

Risk

Low. No runtime behavior, API contract, database, or marketplace content is changed. The PR only updates dependency metadata and CI orchestration.

Rollback

Revert this PR to restore the previous lockfile and workflow.

[criptogus]

A direção desta PR é positiva: substituir a lista manual de arquivos de teste no workflow pelo npm test canônico elimina o drift, e restaurar o npm ci é necessário.

Porém, ela já está desatualizada em relação à main: o package.json atual está em 0.1.92 com @lovable.dev/vite-tanstack-config@2.8.5, enquanto o lockfile desta PR sincroniza para 0.1.80 / 2.8.4. Se mesclada como está, o npm ci voltará a falhar com o mesmo EUSAGE.

Pedido de mudança: rebase na main atual e regenere o package-lock.json contra o manifest vigente (npm install --package-lock-only), confirmando que npm ci && npm test passam. A mudança no .github/workflows/test.yml pode ficar exatamente como está — essa parte está aprovada.

---

Generated by Claude Code