Add CI pipeline, lint config, and scaffold test runner

.markdownlint.json

@@ -0,0 +1,9 @@
+{
+	"default": true,
+	"MD013": {
+		"tables": false
+	},
+	"MD024": {
+		"siblings_only": true
+	}
+}

.shellcheckrc

@@ -0,0 +1,2 @@
+# No disables yet — bin/ scripts land in Phase 2. Add exceptions here only
+# with a comment explaining why, per this workspace's convention.

.woodpecker/test.yaml

@@ -0,0 +1,25 @@
+# Run the plugin's own suites on every push and PR.
+
+labels:
+  # Match the fleet convention: the only amd64 agent crash-loops on gRPC auth
+  # to the server. Every step here is arch-agnostic (shell, git, python), so
+  # arm64 costs nothing.
+  arch: arm64
+
+when:
+  - event: push
+  - event: pull_request
+
+steps:
+  - name: suites
+    image: alpine:3
+    commands:
+      - apk add --no-cache bash python3 >/dev/null
+      - timeout 600 bash tests/run-all.sh
+
+  - name: shellcheck
+    image: koalaman/shellcheck-alpine:stable
+    commands:
+      # bin/ is empty until Phase 2 — degrade gracefully rather than failing
+      # on "no files specified".
+      - sh -c 'files=$(find bin tests -type f \( -name "*.sh" -o -perm -u+x \) 2>/dev/null); if [ -n "$files" ]; then shellcheck $files; else echo "no scripts yet"; fi'

tests/run-all.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Runs every tests/*.test.sh in this directory. Phase 2+ adds real suites;
+# for now it only validates the scaffold itself.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+fail=0
+
+echo "== plugin.json is valid JSON =="
+python3 -c "import json; json.load(open('../.claude-plugin/plugin.json'))"
+
+echo "== design docs present =="
+for f in spec.md plan.md rubric.md tasks.md; do
+	if [ ! -f "../design/$f" ]; then
+		echo "MISSING: design/$f" >&2
+		fail=1
+	fi
+done
+
+shopt -s nullglob
+suites=(./*.test.sh)
+if [ ${#suites[@]} -eq 0 ]; then
+	echo "== no suites yet (Phase 2+) =="
+else
+	for suite in "${suites[@]}"; do
+		echo "== $suite =="
+		bash "$suite" || fail=1
+	done
+fi
+
+exit "$fail"