Brief a coding agent to set up CI that runs your tests on every pull request

Goal: Add a CI workflow that runs our checks on every pull request to {{default_branch}} and on every push to it, so that no change merges without the tests having run.

Context:
- CI system and the file to create: {{ci_file}} (for example .github/workflows/ci.yml for GitHub Actions, or .gitlab-ci.yml)
- Checks to run, in order: {{check_commands}}
- Runtime version: read it from {{version_files}}; do not choose one yourself.
- Package manager and lockfile: {{package_manager}}
- Services the tests need, with versions: {{services}}
- Environment variables the tests need (names and non-secret values only): {{env_vars}}

Constraints:
- Add or change only CI configuration files. Do not touch application code, tests, dependency versions or {{off_limits}}. If a check fails in CI because of the code, report it; do not fix it in this task.
- Install from the lockfile with the clean-install command (for example npm ci), and cache dependencies keyed on the lockfile, using the setup action's built-in cache where there is one.
- Trigger on pull_request, not pull_request_target, so code from forks never runs with write access. Give the workflow read-only permissions (permissions: contents: read) unless a step needs more, and explain why if it does.
- Pin third-party actions to a release tag or a commit SHA. Set a timeout on each job, and cancel superseded runs on the same branch with a concurrency group.
- Run services as service containers with health checks, not with sleeps.
- Do not add deploy, release or publish steps, and do not create or print secrets. If a check needs a secret, stop and tell me its name.

Done when:
- {{ci_file}} exists and passes a workflow linter if one is available (for example actionlint).
- The same commands pass locally in a clean checkout with the versions the workflow uses.
- On a pull request, the checks run and show green. You may push a branch and open a draft pull request only if I say so here: {{pr_permission}}. Otherwise stop after the local run and give me the exact steps to open one.

Verify: run the checks locally, read the output and iterate on the workflow until it is right. Then report in this format: Workflow (the file in full), Jobs (one line each), Cache key, Run time, Commands run with the last 20 lines of their output, and For you to do, such as making the check required in the branch protection settings. If the project files disagree about the runtime version, stop and ask which one is right.