KSN: standardize workflow names and add post-merge sanity check

.github/workflows/keepalive.yml

@@ -1,4 +1,4 @@
-name: Keepalive
+name: 💓 Keepalive
 
 # Supabase pauses a free-tier project after roughly a week without external API
 # traffic, which takes production and the e2e suite down with it. Nothing else in

.github/workflows/ci.yml → .github/workflows/pull-request-checks.yml

@@ -1,10 +1,7 @@
-name: CI
+name: 🧪 Pull request checks
 
 on:
-  push:
-    branches: [main]
   pull_request:
-    branches: [main]
 
 # Least privilege: this workflow only reads the repository. Set explicitly so it
 # stays read-only even if the repo or org default token permission is widened.

.github/workflows/sanity-check.yml

@@ -0,0 +1,45 @@
+name: ✅ Sanity check
+
+on:
+  push:
+    branches: [main]
+
+# Least privilege: this workflow only reads the repository.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  BUN_VERSION: 1.3.14
+
+jobs:
+  sanity-check:
+    name: 🩺 Sanity check
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: 📥 Checkout repository
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: 🥟 Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: 📦 Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: 🚦 Full check
+        run: bun run system-check
+
+      - name: 🎉 All clear
+        run: echo "✅ ${GITHUB_SHA:0:7} landed on \`main\` clean — typecheck, format, lint, tests, and web build all green." >> "$GITHUB_STEP_SUMMARY"
+
+      - name: 🚨 Something broke
+        if: failure()
+        run: echo "💥 ${GITHUB_SHA:0:7} broke \`main\` — check the failed step above." >> "$GITHUB_STEP_SUMMARY"