chore: Add github actions

[volnei]

Summary by cubic

Adds GitHub Actions for CI, auto-labeling, and manual npm publishing. Adds a test script and initial UI Button tests so the Test job runs in CI.

• New Features
  • CI on main and PRs: format, lint, test, then build via reusable workflows; concurrency cancels stale runs.
  • Shared jobs use Bun 1.3.1 with dependency caching for faster runs.
  • PR Labeler applies area/pkg/deps/docs/config labels based on changed paths.
  • Manual publish: select package and semver bump, build with Turbo, bump version, publish with provenance, then commit and tag.

^{Written for commit 971aa04. Summary will update automatically on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
coss-com	Ready	Preview	Comment	Nov 17, 2025 6:32pm
coss-com-origin	Ready	Preview	Comment	Nov 17, 2025 6:32pm
coss-com-ui	Ready	Preview	Comment	Nov 17, 2025 6:32pm

[cubic-dev-ai]

2 issues found across 10 files

Prompt for AI agents (all 2 issues)

Understand the root cause of the following 2 issues and fix them.


<file name=".github/workflows/labeler.yml">

<violation number="1" location=".github/workflows/labeler.yml:4">
Triggering this workflow on pull_request causes labeler runs to fail for forked PRs because the event&#39;s GITHUB_TOKEN stays read-only and cannot add labels. Limit the job to pull_request_target (or guard the step) to avoid failing runs.</violation>
</file>

<file name=".github/labeler.yml">

<violation number="1" location=".github/labeler.yml:38">
The deps label currently ignores dependency manifests under apps/, so updates to apps/*/package.json will not trigger the deps label. Please include the app manifests so dependency PRs are labeled consistently.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}